By Bob Parisi, Head of Cyber Solutions ‒ North America, Munich Re Facultative & Corporate

A cyber risk protection gap is poised to grow as organizations embrace artificial intelligence (AI) and increase their reliance on technology. A gap that will widen due to constantly expanding attack surfaces, as more systems and devices become networked, and threat actors’ tactics continue to evolve with the use of AI. Leaders of organizations therefore should strive to improve their understanding of cyber risk and develop strategies to manage it.

The Munich Re Global Cyber Risk and Insurance Survey 2026 found C-level executives are highly concerned about cyber risk, but almost 9 in 10 executives — 89% — consider their organization’s existing protection level to be inadequate.

Among the cyber risk survey findings:

• 66% of C-level executives believe AI will have positive effects on their organization
• 63% are interested in buying insurance that covers AI risks
• 57% already use AI in their business operations
• 98% rely on cloud services

AI is pervasive but has risks

While most executives surveyed view AI as beneficial to their organization, 23% believe this technology will have negative effects. This points to a need to integrate AI into business operations in ways that preserve advantages while mitigating risks, such as AI model misuse, data exposure, and operational errors.

The survey findings further suggest risks arising from AI and cloud outages could impact a large majority of organizations. C-level executives expressed what concerns them most about using or implementing AI, including:

• Data security and privacy, 52%
• Inaccurate results, 42%
• Cyberattacks, 42%
• Lack of skills and resources, 36%
• Regulation and legal issues, 32%
• Loss of intellectual property, 30%

Cybersecurity preparedness is lacking

Even though C-level executives have high levels of awareness and concern about cyberattacks, 89% said their organization is not adequately prepared. This number has steadily increased from 81% in a similar Munich Re survey conducted in 2021.

The leading challenge to improving cyber threat defenses, according to 40% of executives surveyed, was low security awareness among employees. Following that was a lack of human resources/skilled personnel, cited by 31%, and poor integration or interoperability of security solutions, cited by 30%.

The human element has been and remains the weak link in the security chain. As threat actors deploy more sophisticated social engineering and phishing techniques, often using AI to deceive victims, cybersecurity training has become paramount.

Ransomware and other exploits continue to be key drivers of cyber losses. In a 2025 study of cyber risk trends, Munich Re found four cyber risk “hot spots” that led to losses across many industries: ransomware, scams, data breaches, and supply chain attacks.

The 2026 cyber risk survey asked C-level executives how concerned they were about a potential attack on their company. The global average for concern was 60%. Notably, executives in North America expressed above-average concern about cyberattacks: 62% of executives in Canada and 61% in the United States.

Closing the protection gap

Awareness of cyber risk by C-level executives is high, yet so is the percentage of leaders who believe their organizations are inadequately protected against cyber events. What is needed to close the protection gap?

A good starting point is for risk advisors and brokers to discuss cyber insurance solutions with their clients. Munich Re’s survey found only 52% of executives were offered cyber insurance, while 16% did not know, and 33% said the coverage was not offered to them. In essence, a significant proportion of cyber risks are underinsured or not insured.

The growth opportunity for cyber insurance is massive. Despite steady growth in cyber insurance gross written premiums in North America, global cyber premium volume is only about 1% of worldwide non-life premiums. Looking at this from another point of view, even those organizations that purchase cyber insurance only buy amounts roughly equivalent to 14% of their Probable Maximum Loss (PML) — in insurance, this is the highest financial loss an insurer expects an insured to suffer from a single catastrophic event. Contrast this with traditional property insurance, where organizations typically insure approximately 40% of their PML.

And it is not simply a question of buying more limits. As part of an initiative called “Silent Cyber,” the traditional insurance market engaged in an exercise to ensure that any insurer offering coverage for a cyber-related risk did so either by expressly offering or alternatively expressly excluding cyber risk. Most of the traditional Property & Casualty market chose the latter approach, leaving insureds with a gap in their insurance coverage if a cyber event caused physical property damage.

Of C-suite executives surveyed, 43% said they would consider buying a cyber insurance policy and very likely will do so. This percentage has risen steadily from 35% in a similar survey in 2022 and 41% in 2024.

Closing the cyber risk protection gap will require organizations to analyze their exposures and develop strategies to mitigate and transfer their risks.

How Munich Re can help

With in-depth knowledge of complex industries and extensive expertise in cybersecurity and underwriting, Munich Re Facultative & Corporate’s holistic approach allows us to tailor custom cyber insurance solutions to meet our clients’ needs.

Munich Re F&C helps large organizations mitigate the financial impact of cyber events with broad first- and third-party cyber insurance, including business interruption, contingent business interruption, cyber extortion, ransomware and event response expenses, data and privacy breach, network security liability, payment card industry liability, regulatory defense, and more. Munich Re F&C also offers coverage extensions for technology E&O, property damage from a cyber event, and cyber risks written in captives.

The information presented here is not intended to be legal, underwriting, financial, or any other type of professional advice, and the recipient should consult with its own counsel or other advisors to verify the accuracy and completeness of any information used, and to determine its applicability to the recipient’s particular circumstances. Any descriptions of coverage are meant to be general in nature and do not include nor are intended to include all of the actual terms, benefits, and limitations found in an insurance policy. The insurance policy and not any descriptions or representations made here will form the contract between the insured and insurance company, and governs in all cases. Munich Reinsurance America, Inc. and its affiliates disclaim any and all liability whatsoever resulting from reliance upon this information.