Cyber Security Sleepless Nights: UK Business Leaders Failing to Discuss Risks at Board Level

A significant disconnect between executive anxiety and board-level governance is undermining UK corporate cyber resilience, according to new research. For the insurance sector, this gap between perceived risk and actual oversight presents a major challenge for underwriters and brokers attempting to price risk and ensure clients maintain the robust security postures required for comprehensive coverage.

What was announced

The research, conducted by Censuswide among 500 UK business leaders including C-suite executives and board members, identifies cyber security as the second most pressing priority for organisations, trailing only revenue growth. Despite this high ranking, a significant gap exists in how frequently the topic is addressed during formal governance. While 37% of organisations discuss cyber security at every board meeting, 13% do so in fewer than half of their sessions, and 6% never discuss the issue at board level.

This lack of regular oversight persists despite 32% of leaders admitting they have lost sleep over their organisation's preparedness. Cyber security currently ranks as the third most common cause of executive insomnia, following cashflow concerns and wider economic volatility. The study also highlights a confidence paradox: 90% of respondents believe their board understands cyber security risks, yet fewer than half (46%) describe themselves as very confident in that understanding.

These findings follow a series of high-profile cyber incidents in 2025 involving major UK retailers such as Marks & Spencer, Co-op, and Harrods. These attacks resulted in significant financial losses, data theft, and service disruptions, leading to the introduction of the UK Government and National Cyber Security Centre’s Cyber Governance Code of Practice in 2025 to assist directors in managing these systemic risks. The research suggests that while awareness of these operational and reputational threats is high, many businesses have yet to embed cyber security into routine governance discussions.

"These findings should be a wake-up call for business leaders and board members. Cyber security is no longer a technology issue that can be delegated to IT teams. It is a core business risk with the potential to impact revenue, operations, reputation and trust."

Mike Robinson, CEO at DXR Cyber.

The companies involved

DXR Cyber is a specialist organisation focused on cyber security and digital forensics within the UK market. The firm positions itself as a provider of cyber resilience services, aiming to bridge the gap between technical IT security and core business risk management. DXR Cyber operates as a unified powerhouse in the sector, having brought together multiple specialist capabilities to address the evolving threat landscape faced by British businesses. The company focuses on helping leaders across the supply chain ensure they are cyber resilient in the truest sense, moving beyond simple IT delegation to integrated business risk strategies.

The company is associated with Limerston Capital, a private equity firm reachable at http://www.limerstoncap.com. Limerston Capital typically focuses on investments where it can partner with management teams to drive operational improvements and growth. DXR Cyber’s focus on the UK mid-market and enterprise sectors aligns with the broader market need for sophisticated digital forensics and incident response capabilities. By providing research into boardroom governance, the firm highlights the operational, financial, and reputational damage that cyber attacks inflict on organisations of all sizes.

What FF News has reported before

FF News previously covered the emergence of DXR Cyber as a significant new player in the UK security landscape. In October 2026, the publication reported on the firm's formal entry into the market in DXR Cyber Launches as Unified Powerhouse for UK Cyber Security and Digital Forensics. That report detailed how the brand was established to combine various cyber specialists under a single, unified identity to provide a more comprehensive suite of services to UK organisations. The launch marked a strategic consolidation of expertise in digital forensics and cyber security, aimed at addressing the increasing complexity of threats that the firm’s recent research now shows are keeping executives awake at night.

What this means from an insurtech perspective

From an insurance perspective, the disconnect between executive anxiety and board-level action is a red flag for underwriters. If cyber risk is not a standing agenda item, it suggests that internal controls and incident response plans may not be receiving the investment or scrutiny required to mitigate loss ratios. This puts immense pressure on brokers to move beyond transactional placement and act as risk consultants, ensuring that the "confidence" reported by boards is backed by the governance standards required by the 2025 Cyber Governance Code of Practice. For carriers, this data highlights a persistent challenge in assessing the "human element" of risk; technical scans of a client’s perimeter are insufficient if the boardroom is failing to treat cyber as a core business risk. MGAs and insurers may need to tighten eligibility criteria, rewarding organisations that can demonstrate frequent, documented board-level oversight with more competitive premiums and broader coverage terms.