Exploring Behavioural Strategies in Cyberinsurance Adoption

This study explores decision making around the purchase of cyberinsurance and the impact on cybersecurity behaviours. In an online experiment, involving 4,800 participants across four countries, we found that rational choice models fail to predict cybersecurity decisions. Specifically, individuals tend to opt for an overprotective cybersecurity strategy by ensuring higher protection levels and insurance coverage than expected utility theory would deem necessary. Two key implications are highlighted: Firstly, the need to focus on the human component of cybersecurity, and secondly, the need to develop behaviour-oriented interventions driven by theory and capable of accounting for the non-rational component of cybersecurity decision-making.