From Cyber Risk Transfer to Resilience: Security Information Governance Across the Cyber Insurance Ecosystem

Abstract

The rapid digital transformation and growing reliance on complex information systems have increased organisations’ exposure to cyber risks. Cyber incidents are becoming more frequent, sophisticated, and damaging, leading to significant financial losses, operational disruptions, and reputational harm. Cyber insurance plays an increasingly important role in information security governance by enabling financial risk transfer and providing access to incident response services. However, assessing cyber risk remains difficult for both insurers and policyholders due to the intangible nature of digital assets, the global scale of threats, and limited sharing of actionable threat intelligence. Concerns over privacy, competition, regulation, and trust often hinder data sharing, impairing accurate risk assessment and systemic resilience. This study develops a model of information security information flows within the cyber insurance ecosystem. It explores the types of accessible data and factors shaping security information sharing. The findings offer insights into how improved information sharing can strengthen cyber risk assessment and support cyber resilience.