Willis Highlights Rising Exposure as Cyber Insurance Cover Falls Out of Sync With Actual Risk

Key Takeaways

• Willis Towers Watson warns that policy structures often diverge from the real ransomware and third-party risks organizations face.
• Current research shows ransomware driving 38% of financial losses from cyber events over the past five years.
• Aligning coverage with claims patterns and supply chain exposures is becoming a central focus for risk leaders.

Ransomware and third-party cyber incidents continue to reshape how organizations think about financial exposure, and in June 2026, Willis Towers Watson placed a sharper spotlight on where many companies may be misaligned. The chairman of global FINEX cyber and cyber risk solutions at Willis indicated that gaps often arise when the structure of a cyber insurance policy does not match the organization’s real-world risk posture. That point lands at a time when both insured and uninsured losses tied to ransomware and vendor compromise are hitting record levels.

Over the past five years, ransomware has accounted for 32% of all security incidents and 38% of financial losses, according to the Cyentia IRIS Ransomware Study 2024. The study, available in part through the Cyentia Institute and cited within broader industry analysis, estimates total projected ransomware losses of roughly $276 billion during that period. For many risk managers, these are not abstract numbers. The typical ransomware event now costs $1.4 million, nearly twelve times other incident types, and severe events at the 95th percentile can approach $50 million. That is precisely where policy design becomes a make-or-break issue.

Industry analysts note that cyber insurance coverage varies widely, which means the practical relevance of a policy depends on whether its language and scope mirror the patterns seen in actual claims. Some organizations discover too late that they hold coverage that, while broad on paper, excludes the most financially significant events for their industry. Others pay for components that add little value relative to the threats their sector faces. It is a familiar problem in insurance, but the stakes are rising because cyber events tend to cascade across digital supply chains. When a single vendor is compromised, several downstream businesses may face simultaneous losses.

According to Resilience, cited by Infosecurity Magazine in 2024, third-party risks made up 31% of all client cyber insurance claims and 23% of material financial losses that year. Vendor-targeted ransomware triggered a four-fold increase in third-party losses year over year. This is why aligning coverage parameters is increasingly complex. It is not only the direct attacks that matter but the financial shockwaves created when a critical partner becomes the entry point.

Industry frameworks provide structured methodologies for navigating these overlapping risks, although they sometimes receive less attention than headline statistics. The National Institute of Standards and Technology’s NIST Cybersecurity Framework provides a systematic way for organizations to evaluate their exposure to ransomware and supply chain compromise. Meanwhile, the International Organization for Standardization’s ISO/IEC 27036 offers guidance on supplier relationship security. Neither framework replaces insurance, of course, but they can clarify which digital assets and dependencies matter most. That said, translating that clarity into the right coverage still requires careful work.

Some companies have looked to consulting research from firms such as Deloitte for deeper insight into cyber risk quantification. Deloitte has published broad analyses of supply chain interdependence and ransomware trends, often noting that indirect losses, including operational disruption and legal costs, can exceed initial recovery spending. When combined with findings from insurers like Chubb, which reported that ransomware-related losses in 2023 through 2024 accounted for nearly 72% of cyber claim dollars, these insights show why organizations are revisiting the assumptions inside their existing insurance binders.

Not every organization approaches this reassessment the same way. A manufacturer with a tightly integrated set of suppliers may focus on coverage for contingent business interruption. A financial services firm might prioritize funds transfer fraud and extortion clauses. And a healthcare provider, often working under strict regulatory requirements, may focus on breach response and data restoration. But across sectors, one question keeps emerging: Are companies relying too heavily on the idea that a standard cyber policy will adapt to evolving threats? Industry reports indicate that many buyers assume alignment without verifying it.

That vulnerability stems partly from the pace at which ransomware groups shift their tactics. Over the past two years, for instance, attackers have increasingly targeted managed service providers and software vendors. This creates leverage across multiple clients. When one vendor is compromised, dozens of organizations may be forced into emergency recovery mode. According to the Chubb Cyber Claims Report 2024, this kind of scenario has contributed to a 75% increase in subsequent third-party litigation frequency compared with 2020 through 2021. With litigation now following incidents more commonly, the financial consequences stretch far beyond ransom payments.

Another factor often overlooked is the difference between insured losses and uninsured costs. Organizations that carry policies not aligned with their risk profile may see coverage disputes or exclusions that leave major expenses uncovered. Meanwhile, those without adequate business interruption provisions can face extended downtime. It is not surprising that specialized ransomware resilience providers, including Halcyon and coalition-based risk platforms, are gaining traction as companies look for technical and operational measures to pair with financial protection.

What may matter most in the coming year is a shift in buyer mindset. Rather than treating cyber insurance as a standalone product, companies are beginning to view it as part of a broader risk management system that incorporates cybersecurity frameworks, third-party assessments, and financial modeling. Risk leaders emphasize that organizations seeking stronger value from cyber insurance should design coverage around claims patterns most likely to affect their specific risk profile. It sounds straightforward, yet in practice, it often requires collaboration across legal, IT, procurement, and executive leadership.

As supply chains become more digitized and more interconnected, the cost of coverage misalignment grows. A policy written for yesterday’s threat landscape may not reflect present reality, especially when vendor incidents account for such a significant share of losses. As a result, buyers are increasingly asking for granular visibility into how insurers evaluate third-party exposure. Some insurers have begun integrating continuous monitoring tools, but industry adoption remains inconsistent.

Companies still navigating this shift may find that incremental adjustments are not enough. A deeper review of policy terms, exclusions, and sublimits could uncover vulnerabilities that are not obvious until after an incident. While insurance is not a substitute for strong cybersecurity practices, it plays a critical financial role when ransomware or a partner breach disrupts operations. The gap between technology risk and financial coverage is often smaller on paper than in practice. As current claims data shows, policy misalignment carries quantifiable financial impacts, and organizations that proactively audit their coverage can secure more reliable financial protection against supply chain disruptions.