The increasing frequency of cyber threats poses substantial challenges for organizations in both the private and public sectors. This systematic literature review evaluates and categorizes current cyber risk assessment methodologies and frameworks, supporting the selection of suitable approaches for practical and academic applications. Utilizing the PRISMA framework, 712 relevant studies were filtered from an initial pool of 1900 academic publications and subsequently analyzed and organized into a structured database, providing an overview of the advantages and limitations of widely cited approaches in this domain. The findings indicate a strong preference for established risk management frameworks, including the ISO 27000 family, OCTAVE, and NIST Special Publications, as well as mathematical approaches such as Bayesian networks, fuzzy logic, and multi-criteria decision-making techniques. The 217 approaches identified were grouped into two primary categories: Standards, Frameworks, and Guidelines and Risk Assessment Methods, with further classification by the application sectors addressed in the literature. Analysis suggests that no single approach offers universal applicability. The choice of methodology should therefore be informed by an organization’s specific resources, size, and sectoral requirements. A cross-analysis of methods and sectors reveals gaps in sector-specific coverage, particularly for healthcare, finance, and small and medium-sized enterprises. The review identifies a trend toward hybrid approaches that combine organizational frameworks with quantitative methods and documents persistent barriers to adoption, including cost, data scarcity, and insufficient management engagement. Based on these findings, a conceptual framework is developed to evaluate approaches across five dimensions and to derive a typology of governance-oriented, quantitative, and hybrid methods. Implications for practitioners, regulators, and researchers are discussed in relation to current regulatory frameworks, including the NIS-2 Directive and the Digital Operational Resilience Act (DORA).
Using a firm-level measure of cybersecurity awareness constructed from SEC 10-K filings, we examine how cybersecurity breach incidents influence firms’ cybersecurity awareness and risk disclosure behavior, with a particular focus on information spillovers from peer breaches. We show that our cybersecurity awareness measure captures firms’ perceived underlying cybersecurity risk. Firms significantly increase cybersecurity awareness following their own breach incidents. We further document significant information spillovers: firms increase cybersecurity awareness following breaches experienced by industry peers, although these responses are smaller than those following their own breach incidents and weaker under geographically defined peer groups. Finally, we examine whether these information spillovers are associated with firms’ subsequent breach outcomes. While peer breach information consistently influences firms’ cybersecurity awareness, its association with subsequent breach outcomes is considerably less robust across alternative peer definitions and model specifications.
Systemic cyber risk can cascade across interconnected networks, generating substantial Incurred But Not Reported (IBNR) losses that threaten insurers’ capital adequacy. We present a tractable scenario-based framework for assessing how systemic cyber contagion, reporting delays, and operational resilience can affect cyber IBNR losses and solvency capital requirements under stylized assumptions. This framework employs a stochastic epidemic method (susceptible-infected-recovered model) with the parameters of firms’ operational resilience and sectoral network structure and is intended as a diagnostic device and a stress-testing tool that links contagion timing to capital adequacy. Our analysis shows that firms with more resilient operations may be able to recognize losses more quickly, leading to shorter reporting delays and consequently higher IBNR in the early stages, whereas less resilient firms have longer reporting delays, causing their claims to increase over time. We also find that sectoral comparison reveals more severe systemic impacts in the financial industry than in the information industry, and that large insurers can maintain adequate solvency buffers, whereas smaller insurers may face solvency pressures. These findings highlight the need to incorporate IBNR, operational resilience, and network topology in insurance regulatory models to capture systemic cyber losses.
Criminal history information (CHx) is used by some insurers in screening and underwriting, yet its status as a risk-classification input remains insufficiently theorized. This article argues that the central question is not whether CHx is intrinsically legitimate or illegitimate, but under what conditions it can be admitted as a defensible underwriting signal. CHx may contain insurance-relevant information in selected contexts, but its use requires evidence of incremental, product-specific, and time-sensitive value within the relevant applicant or insured population, not broad correlations in the general population alone. The article maps where CHx can enter the insurance lifecycle (pre-quote screening, underwriting, pricing, claims, renewal, and fraud workflows) and identifies failure modes linked to provenance, data quality, update lag, weak contestability, and defensive underwriting incentives. Drawing on descriptive evidence from an insurance survey on CHx use in life insurance, it develops a conditional-admissibility framework distinguishing defensible risk relevance from persistent status-based exclusion. The article translates this framework into practical mechanisms: contextual human review, redemption-by-design, data minimization, auditable vendor governance, and procedural safeguards. It concludes that CHx use should be demonstrably incremental, time-bounded, contextualized, contestable, and governable across the data supply chain.
Open Insurance applies Open Finance principles to the insurance sector by enabling the sharing of insurance-related data with third-party providers. Despite strong policy interest, empirical evidence on Open Insurance remains very limited. This paper analyses consumer preferences for Open Insurance services using a large-scale survey from the German-speaking insurance markets combined with a choice-based conjoint analysis. The results show that consumers value transparency-enhancing services, such as consolidated overviews of insurance coverage and identification of coverage gaps. Willingness to pay exists but is limited, suggesting challenges for direct monetisation. Trust is a key determinant of acceptance: services offered by established insurers and public institutions are preferred over offerings by new private entrants such as insurtech firms. Overall, the findings indicate that Open Insurance is likely to evolve incrementally rather than disruptively, with trust and usability shaping its economic impact.
