Loss of customer trust, reputational damage seen as greatest cyber risk

After a decade of research, insurance underwriter Hiscox reveals that cyber risk has transformed from a standalone IT issue into a core, board-level business priority shaping continuity, reputation, and growth.

In its latest annual survey, Hiscox found that between 2017 and 2026, corporate focus shifted from basic technical prevention to operational resilience, with concern expanding beyond hackers and breaches to artificial intelligence (AI), supply chains, and personnel. The share of businesses classified as cyber novices dropped from 53% in 2017 to just 3% in 2026, reflecting a landscape where 97% of organisations actively take steps to enhance cyber resilience. Over the period, cyber insurance adoption climbed from 40% to 64%. At the same time, executive accountability deepened: a decade ago, 55% involved leadership in strategy, while 32% now directly link executive remuneration and performance to security outcomes.

Although the proportion of organisations experiencing at least one incident annually fell from 57% in 2017 to 29% in 2026, attacks have become a routine operational hazard. Affected organisations now face an average of four incidents annually, resulting in approximately 32 hours of operational disruption and an average annual cost of $52,000.

The consequences, however, increasingly extend beyond balance sheets. Reputational damage and the loss of customer trust now represent the greatest risk for 48% of businesses, followed by operational downtime (46%) and supply chain disruption(44%). Among organisations that suffered a breach, 28% incurred financial penalties and 26% faced negative publicity, reinforcing that cyber security outcomes directly influence long-term commercial value and market competitiveness.

Training Announcement: The BCS Foundation Certificate in Information Security Management Principles (CISMP) is an entry-level programme aligned with ISO/IEC 27001 and Cyber Essentials that examines the fundamental concepts, technologies and principles of information security management. It provides attendees with practical knowledge of key concepts and techniques in risk management, security operations, and technical, physical, and environmental security. In addition, CISMP addresses legal and regulatory requirements, business continuity and disaster recovery planning, and emerging technologies. Find out more.