Enhancing Cyber Resilience: Insights for UK Businesses

Drawing on discussions at Airmic 2026, AIG cyber specialists highlight three recurring themes, informed by claims experience, incident response support and ongoing work with clients, that contribute to stronger cyber resilience.

1. Understand Your Exposure

"Building cyber resilience starts with getting the fundamentals right," said David Olive, Head of Cyber & Technology, AIG UK. "Controls such as multi-factor authentication, timely patching and well-tested incident response plans can be the difference between a contained disruption and a catastrophic one."

AIG UK's claims experience continues to highlight the significance of these core controls. According to AIG analysis* of cyber notifications received in the UK, more than half of reported incidents had a direct causal link to either the absence of multi-factor authentication or a failure to apply security patches. A further 20% were linked to phishing emails targeting employees.

The data reinforces a consistent message: while cyber threats continue to evolve, many significant losses can still be traced back to weaknesses in fundamental cyber hygiene.

2. Prepare for Incidents Before They Happen

Effective incident response begins long before a cyber event occurs.

AIG’s experience supporting affected businesses and third parties shows how quickly cyber exposures can spread across supply chains: for instance, a breach at one provider can disrupt multiple businesses and geographies. As scrutiny of supply chain risk grows, organisations should assess supplier controls before an incident, including agreeing on notification timelines, liability provisions and legal cost indemnification at contract stage rather than during a crisis.

The same principle applies internally.

Organisations should maintain well-tested incident response and business continuity plans, with clear roles and decision-making authority assigned across functions in advance. This is often what determines both the speed and effectiveness of a response, not decisions made in the heat of the moment.

"Cyber incidents take a team, not one individual," said Nicci Whitehouse, AIG’s Global Cyber Claims Technical Specialist. "Don't underestimate the time involved and have a clear plan and division of responsibilities in place."

3. Keep Pace with Regulatory Change

Beyond operational resilience, organisations must also navigate an evolving regulatory landscape. The Cyber Security and Resilience Bill and Data (Use and Access) Act introduce compliance changes for UK businesses.

“We are in a seminal transition period of legal obligations and corporate governance in respect of cyber risk. Business leaders need to take appropriate and proportionate measures to manage the risks posed to the security of their networks and systems and their legal responsibilities,” said David Olive.