Conceptualising the cyber insurance product: How insurance can enhance risk management frameworks

Cyber risks are one of the top global risks that permeate every aspect of business and society. Yet policyholders lack clarity on the cyber insurance product and are unclear on what constitutes appropriate cyber security measures to prevent or mitigate cyber losses materialising. This can be explained by way of a coverage gap (gaps in the policy), knowledge gap (gaps in understanding cyber risks), and ‘compliance fatigue’. This article dissents with the notion that the primary function of insurance - as a mechanism for the transfer of risk - is adequate to manage cyber exposure. Rather, by analysing the concept of the cyber insurance product, it argues that cyber insurance can (and should) play a broader role to enhance risk management frameworks, thereby creating a synergetic relationship between risk transfer (i.e., insurance) and risk management (i.e., cyber security investments)