When an organization gets hacked, who pays the price?

The global cost of cybercrime has soared in recent years. The average ransomware attack now costs businesses almost $5 million. These are huge sums - but who’s paying? The answer is often insurance companies - but many businesses have come to see insurance as a form of cybersecurity, argues Josephine Wolff, Professor of Cybersecurity Policy at Fletcher School, and that approach unfortunately benefits cybercriminals. Here’s why.  The World Economic Forum’s Global Cybersecurity Outlook 2026 finds that ransomware is the top concern for Chief Information Security Officers, for the second consecutive year.