New York | December 9, 2025
In a global cyber environment marked by major security lapses, cyberattacks, and technology outages, new research released today by Marsh, the world’s leading insurance broker and risk adviser and a business of Marsh McLennan (NYSE: MMC), reveals that organisations around the world are more confident in how they approach cyber risk management and are planning to invest even more in cybersecurity defences in 2026.
The report, Cyber catalyst report: Guiding priorities in cyber investments, draws insights from more than 2,200 cyber risk leaders across 20 countries and eight global regions. The study provides a snapshot of the rapidly evolving cyber risk landscape, revealing critical trends, challenges, and strategic priorities that shape how organisations worldwide manage and mitigate cyber threats.
Among the key findings, nearly 75% of organisations globally express high confidence in their overall cyber risk management strategies. Confidence varies by regions, with organisations in India, Middle East and Africa region expressing the most confidence at 83%, while organisations in Asia are the least confident at 50%.
Additionally, nearly two-thirds (66%) of organisations worldwide plan to increase their cybersecurity investments in the coming year, with more than a quarter (26%) planning to increase their budgets by 25% or more. Top investment priorities include cybersecurity technology and mitigation, incident planning and preparation, and talent acquisition. According to the report, UK organisations lead the way in planned cybersecurity spending increases, with 74% intending to increase their spending over the next 12 months.
“Today’s evolving threat landscape demands not only increased investment but a strategic, holistic approach to cybersecurity,” said Thomas Reagan, Global Cyber Practice Leader, Marsh. “Our survey clearly shows that while many organisations are boosting budgets, true resilience comes from balancing technology, talent, and preparedness—especially in managing third-party risks. This momentum is crucial as ransomware and privacy breaches remain top threats globally, reminding us that cyber defence is no longer optional but a business imperative.”
Among other key findings: 70% of organisations experienced at least one material third-party cyber incident in the past year, underscoring the critical and growing importance of managing third-party and supply chain cyber risks as an integral part of overall cyber resilience strategies; and 29% of global respondents ranked ransomware attacks and privacy breaches as their leading cyber concerns.
