Insurers strengthen cyber governance as oversight shifts to CEOs

About 40% said CEO compensation is now tied to cybersecurity performance.

Insurers and asset managers worldwide are spending more on cybersecurity and giving it greater board-level attention, according to a new survey by Moody’s Ratings.

The report, which covered 102 companies globally, found that most insurers and asset managers now assign cybersecurity oversight to senior executives, with nearly all maintaining multi-year cyber risk strategies. 

About 40% of respondents said CEO compensation is now tied to cybersecurity performance, up from 24% in 2023.

Spending on cybersecurity continues to rise, with nearly half of companies allocating more than 8% of their total technology budgets to cyber resilience in 2025, compared with 45% in 2024. 

Around half also plan to hire more cybersecurity staff in the coming year.

Training and governance have improved, with about two-thirds of companies holding monthly cybersecurity training sessions and 96% giving regular briefings to CEOs. 

Nearly a third of boards now have dedicated cybersecurity committees.

Third-party risk management remains a major focus as attacks increasingly target supply chains. 

Ninety-one percent of respondents said they have formal third-party cyber risk programs, and almost all assess the cyber exposure of software providers.

The study also found growing adoption of AI governance frameworks, with 84% of companies introducing formal policies to control the use of artificial intelligence tools.

Cyber insurance coverage varies widely by region. 

Around 90% of firms in the Americas have standalone cyber policies, compared with 63% in Europe and 38% in Asia-Pacific. 

Despite falling premiums in recent years, 24% of respondents expect higher prices at renewal, whilst all plan to maintain or increase coverage limits.

Moody’s said the findings reflect the sector’s push to strengthen governance, invest in talent, and manage rising risks linked to digital transformation.