_{Executive Summary}

Why it matters

Believing risk is under control doesn’t make it so. The cost of untested resilience is measured in lost revenue, regulatory penalties, and shareholder disputes and that cost is rising faster than boards expect.

Headlines for the boardroom

Ransomware: Boards expect days of downtime.
Claims show three weeks.

Vendors: Managing contract gaps costs thousands.
Ignoring them costs millions.

AI: Boards see opportunity.
Claims show it’s already funding fraud.

Testing: Regulators now expect boards to
rehearse their plans — not just have them.

Executive Summary

Cyber in Focus 2025 brings together two powerful vantage points global cyber claims and board-level perception to show where confidence diverges from reality, and what that gap is costing.

Boards report growing confidence in their resilience. The data tells a different story.

Boards often believe risk is contained. The data proves otherwise. Gaps in testing, cover, and governance are where firms lose revenue, reputation, and regulatory standing.