Do you remember that old Avis commercial about which company was the No. 1 car rental company? Avis used the slogan, “We’re No. 2, but we try harder.” You might say that about cyber risk and hackers, too: Cyber risk is the second biggest concern for U.S. businesses, according to the second annual Travelers Business Risk Index. But hackers are trying harder to breach data security and obtain private information, which could see the risk rise to No. 1 soon.

“The top three concerns are indicative of the ever-evolving risks that pose threats to American businesses,” says Michael Klein, executive vice president and co-president of Business Insurance at Travelers. “Yet, when it comes to managing risk, businesses are often least prepared for their most worrisome concerns. Fortunately, many of these risks can be mitigated and resources are available to help businesses of any size stay protected.”

Business leaders seem to be more optimistic than they were last year, however. Fewer survey respondents reported concerns about the economy and fewer believe the world is becoming riskier.

Cyber risks

Up from fifth place last year, cyber risks ranked as the second biggest concern for all businesses. Malicious and criminal attacks concern businesses the most (55%), along with human error (24%) and system glitches (21%).

The types of malicious attacks most worrisome to businesses include the following:

  • Having computers or data systems infected with a virus (57%)
  • Someone gaining access to their banking accounts or financial control systems (51%)
  • A security breach or someone hacking into their computer systems (50%)

Among leaders of large businesses, 70% rank cyber risks as their biggest concern.

Click through to see what other risks made the Top 5 this year, including the biggest one on executives’ minds.

Travelers 2015 Business Risk Index

Source: Travelers

Medical cost inflation tops the list

Medical cost inflation worried more survey respondents (60%) than any of the other risks in the 2015 Travelers Business Risk Index. Although many business decision makers indicated concern with this issue, it was not as important a concern as last year (60% versus 67% in 2014). Slightly more than one-third (33%) of respondents said that medical cost inflation is among the risks they are least prepared to manage.

Here is the way the respondents ranked other risks:

Legal liability. Legal liability-related risks continue to be another significant source of concern for 56% of business decision makers, the survey found. Specific concerns include the following:

  • Professional mistakes, errors and omissions (42%)
  • Employee lawsuits for discrimination, harassment and wrongful termination (34%)
  • Customer slips and falls and driving accidents caused by employees (33%)

Global political conflict. Among business leaders, one of the most significant increases in concerns is related to global conflict. It’s a concern for 32% of survey respondents, up 8% from 2014. Political unrest is a larger concern today than it was five to 10 years ago for one-quarter of the decision-makers surveyed, which is an increase of 4% from 2014.

Weather. Severe weather has become more frequent said 52% of the respondents, but only 38% believe that is the case for their geographic area, and only 32% believe that it has increased the likelihood of damage to their business. The Northeast stood out as a notable exception: 51% believe that severe weather is more frequent in their area. Surprisingly, only 41% of survey respondents have a business disaster recovery plan in place to help them get back to normal after a disaster.

Risk management. Risk management was not a strategic priority for most survey respondents, especially among decision-makers at small businesses. Of that group, only 11% named risk management as a strategic priority or an important management activity, compared with 20% of medium-sized businesses and 36% of large companies.

About the survey

Hart Research conducted a national online survey of 1,210 business decision-makers from Feb. 18, 2015, to March 4, 2015. Small businesses are defined as those having 2–49 employees, mid-sized businesses as having 50–999 employees, and large business as having 1,000 employees or more. For full results, including industry specific information, click here.