Executives Say Their Companies Are Not Adequately Protected Against Cyberattacks

Why It Matters

The widening confidence gap underscores urgent need for stronger cyber resilience and broader insurance adoption, reshaping risk‑management priorities across industries.

Key Takeaways

• 89% of global C‑suite say cyber protection is insufficient
• AI now top strategic tech, but raises new security concerns
• 62% predict a one‑day cloud outage cuts >11% daily revenue
• Only 52% have ever been offered cyber insurance, leaving gap
• 43% plan to buy cyber policies, up from 35% in 2021‑22

Pulse Analysis

The Munich Re 2026 Global Cyber Risk and Insurance Survey paints a stark picture: nearly nine in ten C‑level leaders feel their organizations are under‑protected against cyber threats. This sentiment, at its highest in four years, reflects a broader shift as digital transformation accelerates and AI assumes a central role in business strategy. While 71% of executives now view AI as a critical driver, the technology also introduces fresh vulnerabilities—data privacy, inaccurate outputs, and automated attacks—heightening the overall risk profile.

Parallel to rising concern, the market for cyber insurance is gaining traction but remains fragmented. Only about half of surveyed executives have ever received an offer for a cyber policy, despite 43% actively considering purchase, up from 35% in prior years. Insurers are urged to expand distribution channels and improve product transparency to capture this untapped demand. The survey also highlights operational exposure: 98% of firms rely on cloud services, and a single‑day outage could erode more than 11% of daily revenue, underscoring the financial stakes of inadequate coverage.

For corporate leaders, the findings signal a clear call to action: embed cyber resilience into core risk‑management frameworks, invest in employee security awareness, and partner with insurers that provide not just indemnity but expert response services. As AI lowers the barrier to sophisticated attacks, firms—especially midsize and micro‑enterprises—must abandon the myth of being too small to be targeted and adopt proactive, integrated defense strategies to safeguard their digital assets and maintain stakeholder confidence.