A Game-Theoretic Framework for Cyber Governance in a World of Persistent Threat

The paper identifies the problem that traditional cybersecurity approaches overemphasise technical vulnerabilities and isolated risk management, while overlooking the strategic and institutional dynamics that shape cyber risk outcomes. Its purpose is to propose a game-theoretic framework for cyber governance that reconceptualises cyber risk as the equilibrium outcome of interactions among threat actors, SMEs, regulators, insurers, and assurance providers. The study uses a conceptual method grounded in game theory and institutional analysis, integrating strategic interaction, signalling theory, repeated games, and bounded rationality to model cyber governance as an adaptive multi-actor system. The results show that governance structures shape attacker and defender incentives by altering payoff structures through regulation, assurance, and oversight, while information asymmetries, signalling, and repeated interactions produce persistent equilibrium outcomes. It further finds that governance interventions such as transparency, compliance, and proactive signalling can shift systems toward more secure equilibria and reduce moral hazard, particularly for SMEs operating under uncertainty. The paper concludes that cyber risk is fundamentally an institutional and strategic outcome rather than a purely technical issue, contributing a game-theoretic governance framework that integrates institutional design, information asymmetry, and risk management to inform policymakers, assurance providers, and decision-makers seeking improved cybersecurity resilience.