Corporate boards often express confidence in their cyber readiness, yet a new report from Willis, a WTW business, finds that actual cyber losses are "longer, broader, and costlier" than expected. The Cyber in Focus 2025 report, based on 4,650 cyber claims and board-level data, reveals that this confidence is fragile when tested by real-world events. The report identifies four key areas that boards consistently misjudge: revenue, reputation, resilience, and regulation. Regarding revenue (downtime), boards assume ransomware outages last only a few days, but claims data shows the median outage is 24 days, with the average ransomware loss standing at US$2.7 million. For reputation (vendor risk), leaders often see this as secondary, even though approximately 50% of breaches start with suppliers. Weak liability, audit, and notification clauses in vendor contracts drive up costs, and regulators are increasingly expecting proof of vendor oversight. In terms of resilience (tested readiness), most boards report having a plan, but only 68% have tested it in the past year. Both regulators and insurers now look for evidence that controls work in practice, not just in policy statements. Finally, concerning regulation (rising accountability), emerging frameworks such as the EU AI Act, evolving U.S. state rules, and new critical-infrastructure legislation in Hong Kong, are raising expectations for governance, incident response, and disclosure. Additional findings from the report indicate that publicly-held companies account for 36% of total losses despite experiencing fewer incidents. The largest single claim recorded reached US$331 million. The data also shows that while boards focus on the upside of AI, claims already involve deepfakes, synthetic IDs, and generative malware being used to commit fraud. Peter Foster, Chairman, Global FINEX Cyber and Cyber Risk Solutions at Willis, states that "Boards often believe cyber risk is contained, but the data proves otherwise". He adds that "Untested plans, weak vendor contracts, and unclear wordings are exactly where firms lose money, reputation, and regulatory standing". Foster notes that the cost of "untested resilience" is rising faster than boards expect, showing up in lost revenue, shareholder disputes, and fines. He suggests that policy optimisation, AI governance, vendor analytics, and ransomware simulations can help to "bridge the gap between perception and reality".
