Cyber risk rises up the boardroom agenda

The latest Directors’ & Officers’ Liability Insurance Survey 2026: Cyber in Focus from Willis, a WTW business, finds that seven in ten organisations have now formally integrated cyber risk into their board-level enterprise risk framework, with 65% receiving cybersecurity and threat updates at least quarterly.

60% of the recipients said that they quantify potential financial losses from a cyber incident annually or on an ongoing basis, and yet despite these figures, only 55% feel well-informed about the cyber risks that face their organisation.

Glyn Thoms, Global FINEX cyber strategy leader finds that, “Cyber risk is now a core business risk, demanding greater board oversight and accountability.”

Thoms also highlighted the role of cyber insurance, describing it as “no longer simply a risk transfer solution” but increasingly recognised as “an enabler of resilience”.

Almost half of the respondents had cyber insurance in place, with 19% planning to purchase within two years, something that Willis says is being increasingly viewed as part of organisational resilience.

While cyberattacks cannot always be prevented, Willis emphasised the importance of being able to respond to incidents, recover and minimise disruption.

For ports, cybersecurity proves particularly relevant amidst increasing digitalisation connecting multiple networks, including terminal operating and cargo-handling systems. There is a need for an acute awareness of the cyber risk on ports.

A report from World Bank Group, in May this year, demonstrated that 61% of port authorities consider cyber incidents a high risk, with the average cost per maritime cyber incident coming to $550,000 from data in 2023.

The report also identified disparities in preparedness between high-income and low- and middle-income countries. Nearly 80% of port stakeholders in high-income countries had conducted a cybersecurity risk assessment in the previous 24 months, compared with just over 55% in low- and middle-income countries.

The findings sit alongside broader industry figures from Willis, which found that 62% of respondents had completed a cyber incident response testing exercise in the previous 12 months. While 78% had a cyber incident response plan in place, only 63% felt well prepared to manage an incident effectively.

Together, the findings highlight the importance of translating awareness of cyber risk into practical preparedness. For port operators, this means ensuring they have the procedures and tested response plans needed to recover from incidents and minimise operational disruption.