Directors and Officers (D&O) insurance insights

Cyber-related D&O liability risks have risen sharply in recent years with higher expectations for board-level oversight of cyber security and a trend toward more litigation and regulatory actions. Cyber is now an increasing cause of claims against directors, resulting from incidents such as data breaches, ransomware attacks and even technical glitches and operational errors.

Cyber exposures for D&Os typically arise from their duty to oversee the organization’s cyber security posture. Should a cyber incident result in financial loss, directors could potentially face legal claims from shareholders, customers or suppliers (and in some cases, from the company itself) if the board is perceived to have failed to implement adequate cyber risk controls or business continuity plans. Directors could also conceivably face shareholder litigation for a lack of cyber insurance coverage. And while they might not be at fault, they can still face significant defense and investigation costs.

Willingness to seek damages in court is increasing, partly out of fear of recourse claims by shareholders or supervisory authorities. The threshold for asserting internal liability is falling while the number of cyber-attacks with a systemic impact has increased. At the same time, companies and their directors also face an evolving regulatory environment. In addition to comprehensive data privacy laws, policymakers have been turning their attentions to operational cyber resilience. In Europe, the Network and Information Security directive (NIS2) is extending robust cyber security and reporting standards to more companies and their supply chains – failure to comply can result in fines of up to €10mn or 2% of global turnover. It also increases the personal accountability for D&Os, who will be directly responsible for overseeing cyber security, risk management and incident response preparedness. If companies and their directors invest in cyber security, have a solid business continuity plan and robust data privacy controls, they are less likely to face litigation or regulatory action.

First developed in the 1940s, per- and polyfluoroalkyl substances (PFAS) have since been used for a wide range of industrial and consumer products, from food packaging to firefighting foams. But these so-called forever chemicals have also been linked to serious health issues. Recent years have seen mounting litigation, much of it stemming from environmental contamination and product safety concerns (mostly in the US, although there have also been civil proceedings in Europe, Canada and Australia). It has been predicted that PFAS water contamination and environmental litigation could eventually cost in excess of US$100bn in the US alone, depending on how regulatory and legal trends evolve.

From a D&O perspective, PFAS-related liability is a potential source of claims, namely through corporate and securities litigation. Like other event-driven D&O losses, there have been cases where shareholders alleged that the directors failed to identify potential PFAS liability exposures and did not adequately disclose those risks to investors. If the stock price drops, investors may point the finger at D&Os, alleging this was a risk they should have been aware of and disclosed. Such issues highlight the need for boards to be more forward-thinking when identifying and disclosing emerging risks – directors need to seek guidance when it comes to disclosure, as this is where they can be vulnerable.

Bankruptcy and regulatory enforcement actions are among the top sources of private D&O claims, although claims can also arise for breach of fiduciary duty, such as misleading or inadequate disclosure, or negligence. The current challenging business environment – marked by factors such as tariffs, weak demand, rising costs and technological transformation – is heightening the risks of such claims against directors of private companies. 

Global business insolvencies are expected to rise by +6% in 2025 and +5% in 2026, Allianz Trade forecasts. Next year will thus mark five consecutive years of increases to reach a record high number of bankruptcies, +24% above the pre-pandemic average. There has also been a notable rise in “mega bankruptcies” in the US – those filed by companies with over US$1bn in reported assets.

D&Os’ liabilities are heightened during and following bankruptcy proceedings. The conduct of directors during the period a company approaches insolvency will fall under closer scrutiny by stakeholders once bankruptcy is declared. This is true whether the insolvent company is large or small, or public or private. Even the suggestion that a business may be in financial distress can increase the risk of litigation as lenders, investors and other parties look to protect their interests.

Bankruptcy filings or insolvency are not always certain to result in D&O claims but when they do they can be costly, In the event of a company failure, creditors and bankruptcy trustees may look to recover funds by targeting D&Os, exposing them to potentially large defense costs. It is important that directors understand their expanded fiduciary duties in the event of insolvency, seek expert advice and keep detailed records of all key decisions and supporting information. Such information will prove critical if D&Os face claims of mismanagement or allegations of conflicts of interest.

Ultimately, D&O liability continues to develop at a quick pace. Against this backdrop, over the past three years there has been a continual increase in the frequency of new claims against D&Os, now approaching or exceeding pre-pandemic rates in most regions of the world. Claims severity continues to be an issue in North America in particular.