Melbourne | December 10, 2025
In a global cyber environment marked by major security lapses, cyberattacks, and technology outages, new research released today by Marsh, the world’s leading insurance broker and risk advisor and a business of Marsh McLennan (NYSE: MMC), reveals that organizations around the world are more confident in how they approach cyber risk management and are planning to invest even more in cybersecurity defenses in 2026.
The report, Cyber catalyst report: Guiding priorities in cyber investments, draws insights from more than 2,200 cyber risk leaders across 20 countries and eight global regions. The study provides a snapshot of the rapidly evolving cyber risk landscape, revealing critical trends, challenges, and strategic priorities that shape how organizations worldwide manage and mitigate cyber threats.
Among the key findings, nearly 75% of organizations globally express high confidence in their overall cyber risk management strategies. Confidence varies by regions, with organizations in India, Middle East and Africa region expressing the most confidence at 83%, while organizations in Asia are the least confident at 50%.
Additionally, nearly two-thirds (66%) of organizations worldwide plan to increase their cybersecurity investments in the coming year, with more than a quarter (26%) planning to increase their budgets by 25% or more. Top investment priorities include cybersecurity technology and mitigation, incident planning and preparation, and talent acquisition. According to the report, UK organizations lead the way in planned cybersecurity spending increases, with 74% intending to increase their spending over the next 12 months.
“Today’s evolving threat landscape demands not only increased investment but a strategic, holistic approach to cybersecurity,” said Thomas Reagan, Global Cyber Practice Leader, Marsh. “Our survey clearly shows that while many organizations are boosting budgets, true resilience comes from balancing technology, talent, and preparedness—especially in managing third-party risks. This momentum is crucial as ransomware and privacy breaches remain top threats globally, reminding us that cyber defense is no longer optional but a business imperative.”
Among other key findings: 70% of organizations experienced at least one material third-party cyber incident in the past year, underscoring the critical and growing importance of managing third-party and supply chain cyber risks as an integral part of overall cyber resilience strategies; and 29% of global respondents ranked ransomware attacks and privacy breaches as their leading cyber concerns.
