Financial services companies worldwide expect to increase cyber-security investment by as much as 40% next year, Willis Towers Watson says.

A survey by the insurance group and think thank ESI ThoughtLab found 71% of all global companies have been significantly affected by cyber attacks in the past year, up 14 points on the previous year, and annual losses per company averaged $US4.7 million ($6.69 million).

More than one in 10 businesses lost more than $US10 million ($14.22 million). Cyber-security investments increased 17% last year on average.

About 43% of financial services businesses suffered large impacts from abuse of legitimate IT access. Email servers, mobile connectivity and web-facing applications were the most vulnerable to cyber attacks in the industry.

Businesses in the sector lost an average of $US7.17 million ($10.20 million) to cyber attacks, or 0.084% of their revenue.

The study covered 467 businesses across 17 countries, in multiple industries.

Companies in China, India and Japan suffer more attacks and higher average losses than in other regions. India is the least cyber-secure country.

Losses are soaring due to cyber attacks by state-sponsored hackers, cyber criminals and malicious insiders, plus companies exposing themselves to threats through the use of interconnected devices and cloud computing.

Willis Towers Watson Cyber Leader for Asia Jessica Wright says it may take companies more than five years to feel the full financial impact of a cyber attack, through lost opportunities, reputational damage and loss of customers, particularly if their competitive advantage is damaged.