Cyberattacks and data loss remain among the top threats facing directors and officers (D&Os) globally, according to the latest Cyber Directors’ and Officers’ Survey Report by Willis, a WTW business. The report gathers insights from organisations across multiple sectors, with the services industry accounting for 24 per cent of respondents and finance and insurance 19 per cent. Over half of those surveyed represent for-profit private companies. Among regions, the UK is the only one to rank cyberattacks (excluding cyber extortion) as the number-one risk, while counterparts in North America and the Middle East cite data loss as their primary concern. Despite a string of high-profile incidents, the perceived threat of cyber-attacks drops slightly, with risk ranking down by 2 per cent between 2024 and 2025. The report explores various factors behind this shift, including changing board-level engagement and evolving risk management strategies. The frequency of cybersecurity updates to boards has increased, with the number of organisations providing monthly updates rising from 18 per cent in 2024 to 28 per cent in 2025. Meanwhile, those only reporting in response to an incident has declined from 20 per cent to 12 per cent. Sponsorship trends suggest that more organisations are involving officers beyond senior leadership, reflecting the need to integrate both strategic and technical expertise. Incident readiness is also improving, with 80 per cent of respondents confirming they have a cyber incident response plan in place, and over two-thirds having tested their response within the past year. Preparedness has risen, with 65 per cent feeling equipped to manage an incident effectively, compared to 56 per cent the previous year. Cybersecurity budgets are expected to grow further in 2025, though at a slower pace than in 2024 — 56 per cent of respondents plan to increase spending, compared with 63 per cent the year before. Cyber risks also play an increasingly central role in D&O insurance, with 53 per cent of respondents already holding cyber cover and a further 18 per cent planning to purchase it within two years. Adrian Ruiz, head of FINEX GB Cyber and TMT at WTW, says: “Building a strong cybersecurity culture that engages all levels of the organisation is critical to managing today’s evolving threats. “From investing wisely in training and technology to regularly testing response plans, businesses must take a proactive, strategic approach to cyber risk. The survey highlights the importance of staying informed and adapting in an increasingly complex digital landscape.”
