Maturity-Aware Cyber Insurance Optimization in IoT Networks

As the rapid evolution and expansion of Internet of Things (IoT) devices continues to accelerate, modern infrastructures face increasing cyber risks, largely driven by device inter-connectivity, limited security maturity, and interdependent attack propagation across networks. Traditional cyber insurance models often overlook these IoT-specific characteristics, relying on uniform or simplified risk assumptions that fail to capture real-world vulnerabilities. To address this gap, this paper presents a maturity-aware cyber insurance optimization framework tailored for interconnected IoT environments. The framework integrates organizational security maturity, interdependent risk propagation modeled through a modified Susceptible–Infected–Susceptible (SIS) process, and a Stackelberg game formulation that captures strategic interactions between the insurer and the defender. Through numerical studies on representative IoT topologies, we demonstrate that maturity-aware, risk-sensitive premium structures quantitatively outperform uniform pricing baselines in cost-efficiency and insurer sustainability. Specifically, our experimental results reveal that operating at an optimal intermediate maturity level (M=3) reduces the defender’s total expected cost by approximately 40% (from 255.38 k to 152.36 k) compared to the baseline state (M=1). Furthermore, this structural hardening triggers an 88.3% reduction in full-coverage insurance premiums (from 225.38 k to 26.36 k). In contrast, our uniform-pricing baseline exhibits reduced profitability in our experiments due to cross-subsidization effects, reinforcing the value of tiered, risk-proportional pricing for mitigating adverse-selection incentives. In summary, this work establishes a tractable, economically viable framework for cyber insurance in IoT ecosystems and provides a foundation for future extensions to richer network settings.