CYBERSECURITY READINESS FOR CYBER INSURANCE ADOPTION AMONG SMES: A SYSTEMATIC LITERATURE REVIEW
DOI:
https://doi.org/10.35631/JISTM.1145001Keywords:
Cyber Insurance, Risk Transfer, Cyber Risk, Cybersecurity, Small Medium EnterpriseAbstract
Small and medium-sized enterprises (SMEs) are increasingly dependent on digital technologies to support business operations, creating greater exposure to cyber threats and potential financial losses. Cyber insurance offers a mechanism for transferring certain financial consequences of cyber incidents; however, limited cybersecurity readiness, financial constraints, and insufficient technical expertise may affect the ability of SMEs to adopt appropriate cybersecurity measures and make informed cyber insurance decisions. This systematic literature review aims to identify and synthesise the organisational, technological, and financial factors influencing cybersecurity readiness among SMEs and examine their implications for cyber insurance adoption. The review applies the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) framework, using advanced search strategies in the Scopus and Web of Science databases. Searches were conducted using combinations of the keywords “Cyber Insurance,” “Risk Transfer,” “Cyber Risk,” “Cybersecurity,” and “Small and Medium Enterprises,” covering publications from January 2022 to August 2026. Following the identification, screening, and eligibility assessment processes, 24 primary studies were included in the final qualitative synthesis. The thematic analysis identified three major themes: (1) Cybersecurity Readiness and Adoption, (2) Cybersecurity Frameworks and Operational Resilience, and (3) Cyber Risk Assessment and Investment Decisions. The findings indicate that cybersecurity awareness, organisational capabilities, security control implementation, operational resilience, and financial resources are interconnected factors influencing SME cybersecurity preparedness. However, the reviewed studies provide limited direct empirical evidence linking cybersecurity readiness to cyber insurance adoption. The review concludes that a comprehensive approach integrating cybersecurity readiness assessment, operational resilience, and cyber risk investment considerations may provide a foundation for developing a cyber insurance framework tailored to the operational and financial characteristics of SMEs.
Downloads
References
Abouzahra, A., Sabraoui, A., & Afdel, K. (2020). Model composition in Model Driven Engineering: A systematic literature review. Information and Software Technology, 125(May), 106316. https://doi.org/10.1016/j.infsof.2020.106316
Acquah, E. (2026). Adverse Selection and Moral Hazards: Information Asymmetry as a Source of Market Failures in Insurance and Finance. American Journal of Applied Statistics and Economics. https://doi.org/10.54536/ajase.v5i1.6099
Adriko, R., & Nurse, J. (2024a). Cybersecurity, cyber insurance and small-to-medium-sized enterprises: a systematic Review. Inf. Comput. Secur., 32, 691–710. https://doi.org/10.1108/ics-01-2024-0025
Adriko, R., & Nurse, J. R. C. (2024b). Does Cyber Insurance Promote Cyber Security Best Practice? An Analysis Based on Insurance Application Forms. Digital Threats: Research and Practice, 5(3). https://doi.org/10.1145/3676283
Ahmad, K. H. (2026). Laying the Digital Foundation : Enforcing Minimum Industry 4 . 0 Standards for New SME Factories in Saudi Arabia. 1–20.
Alassaf, N., Manickam, S., Odeh, A., Arfeen, S. U., & Anbar, M. (2025). The Future of AI in Cybersecurity Insurance. In Cybersecurity Insurance Frameworks and Innovations in the AI Era (pp. 139–178). IGI Global. https://doi.org/10.4018/979-8-3373-1977-3.ch006
Alassaf, N., Manickam, S., Odeh, A., ul Arfeen Laghari, S., Anbar, M., Aboshgifa, A., & Belhaj, N. (2025). Leveraging AI to Establish Cybersecurity Insurance Benchmarks and Guidelines: Standards in Cybersecurity Insurance. In AI-Driven Cybersecurity Insurance: Innovations in Risk, Governance, and Digital Resilience (pp. 111–150). IGI Global. https://doi.org/10.4018/979-8-3373-5545-0.ch005
Alhassani, M., & Alawida, M. (2025). Re-Shaping the World of Cyber Insurance: A New Era of AI in the Cyber World. In Cybersecurity Insurance Frameworks and Innovations in the AI Era (pp. 1–20). IGI Global. https://doi.org/10.4018/979-8-3373-1977-3.ch001
Almoaigel, M. F., & Abuabid, A. (2023). Implementation of Cybersecurity Situation Awareness Model in Saudi SMEs. 14(11), 1082–1092.
Auyporn, W., Piromsopa, K., & Chaiyawat, T. (2023). A Study of Distinguishing Factors between SME Adopters versus Non-Adopters of Cybersecurity Standard. 1(1).
Awan, M., Alam, A., Khan, R. A., & Alwageed, H. S. (2026). OPEN A generative AI-driven cybersecurity framework for small and medium enterprises software development : an ANN-ISM approach. 1–41.
Awiszus, K., Knispel, T., Penner, I., Svindland, G., Voß, A., & Weber, S. (2023). Modeling and pricing cyber insurance. European Actuarial Journal, 13(1). https://doi.org/10.1007/s13385-023-00341-9
Bahmanova, A. (2026). Predictive Cyber Risk Analytics and Computational Risk Metrics for SME Cyber Resilience Using Time-Series Modelling.
Bahmanova, A., & Lace, N. (2026). Journal of Open Innovation : Technology , Market , and Complexity Key factors shaping collaborative cyber resilience in SMEs through open innovation. Journal of Open Innovation: Technology, Market, and Complexity, 12(1), 100715. https://doi.org/10.1016/j.joitmc.2026.100715
Bailey, L. (2020). Mitigating Moral Hazard in Cyber-Risk Insurance. https://consensus.app/papers/mitigating-moral-hazard-in-cyberrisk-insurance-bailey/6f7952ad3ee151bd85c1373b88f6f9e4/
Bardopoulos, J. (2025). Cyber-insurance pricing models. British Actuarial Journal, 30. https://doi.org/10.1017/s1357321724000205
Biener, C., Eling, M., & Wirfs, J. H. (2014). Insurability of Cyber Risk: An Empirical Analysis. The Geneva Papers on Risk and Insurance - Issues and Practice, 40, 131–158. https://doi.org/10.1057/gpp.2014.19
Böhme, R., & Schwartz, G. (2010). Modeling Cyber-Insurance: Towards a Unifying Framework. https://consensus.app/papers/modeling-cyberinsurance-towards-a-unifying-framework-böhme-schwartz/500c91826638542fa5a8f29e1866f927/
Chan, K. C., & Gururajan, R. (2025). A Human – AI Collaborative Framework for Cybersecurity Consulting in Capstone Projects for Small Businesses.
Cremer, F., Sheehan, B., Fortmann, M., Mullins, M., Murphy, F., & Materne, S. (2024). Bridging the cyber protection gap: An investigation into the efficacy of the German cyber insurance market. Risk Management and Insurance Review, 27(1), 57–87. https://doi.org/10.1111/rmir.12261
Franke, U. (2017). The cyber insurance market in Sweden. Computers and Security, 68. https://doi.org/10.1016/j.cose.2017.04.010
Haraldsson, A.-L., Padyab, A., & Salek, A. Al. (2025). Bridging the Gap Between Businesses and Insurers: A Systematic Review of Cyber Insurance Research. International Journal of Information Security and Cybercrime. https://doi.org/10.19107/ijisc.2025.02.01
Herath, H., & Herath, T. (2011). Copula Based Actuarial Model for Pricing Cyber-Insurance Policies. 2. https://consensus.app/papers/copula-based-actuarial-model-for-pricing-cyberinsurance-herath-herath/e84be1ef0b0b5ef4abd8eff10baed72e/
Hui, W., Hui, K.-L., & Yue, W. T. (2024). Cyber Insurance and Post-Breach Services: A Normative Analysis. Service Science, 16(2), 124–141. https://doi.org/10.1287/serv.2021.0120
Id, J. M., Waleed, A., Jamali, A. F., & Masood, A. (2024). Cybersecurity on a budget : Evaluating security and performance of open-source SIEM solutions for SMEs. 1–24. https://doi.org/10.1371/journal.pone.0301183
Ilca, L. F., Lucian, P., & Balan, T. C. (2023). Enhancing Cyber-Resilience for Small and Medium-Sized and Response.
Info, A., On, R., On, R., On, A., Print, I., & Online, I. (2026). Assessment of cybersecurity investment and customer trust in SMEs of South Africa. https://doi.org/10.21511/ppm.24(3).2026.06
Jason Nurse, R. C., Axon, L., Erola, A., Agrafiotis, I., Goldsmith, M., & Creese, S. (2020). The Data that Drives Cyber Insurance: A Study into the Underwriting and Claims Processes. 2020 International Conference on Cyber Situational Awareness, Data Analytics and Assessment, Cyber SA 2020. https://doi.org/10.1109/CyberSA49311.2020.9139703
Kesan, J., & Hayes, C. (2017). Strengthening Cybersecurity with Cyberinsurance Markets and Better Risk Assessment. Minnesota Law Review. https://doi.org/10.2139/ssrn.2924854
Kioskli, K., Seralidou, E., Mallouli, W., Koutras, D., Tomás, P., & Kallergis, D. (2026). A Human-Centric AI-Enabled Ecosystem for SME Cybersecurity : Cross-Sectoral Practices and Adaptation Framework for Maritime Defence. 1–19.
Kitchenham, B., & Charters, S. M. (2021). Guidelines for performing Systematic Literature Reviews in Software Engineering Guidelines for performing Systematic Literature Reviews in Software Engineering. October.
Koch, R. (2024). Current developments in cyber insurance. Zeitschrift fur die gesamte Versicherungswissenschaft, 113(1), 11–53. https://doi.org/10.3790/zverswiss.2024.1430501
Li, Z., & Liao, Q. (2023). Does Cyber-Insurance Benefit the Insured or the Attacker? – A Game of Cyber-Insurance. In F. J., K. T., & H. Y. (Eds.), Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics): Vol. 14167 LNCS (pp. 23–42). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-3-031-50670-3_2
Liu, S., & Zhu, Q. (2022). Mitigating Moral Hazard in Cyber Insurance Using Risk Preference Design. ArXiv, abs/2203.12001. https://doi.org/10.48550/arxiv.2203.12001
Liu, S., & Zhu, Q. (2026). Cyber Insurance for Cyber Resilience. In Autonomous Cyber Resilience (pp. 139–181). wiley. https://doi.org/10.1002/9781394215416.ch06
Lockwood, C., Munn, Z., & Porritt, K. (2015). Qualitative research synthesis: Methodological guidance for systematic reviewers utilizing meta-aggregation. International Journal of Evidence-Based Healthcare, 13(3), 179–187. https://doi.org/10.1097/XEB.0000000000000062
Majuca, R., Yurcik, W., & Kesan, J. (2006). The Evolution of Cyberinsurance. ArXiv, abs/cs/0601020. https://doi.org/10.48550/arxiv.cs/0601020
Markopoulou, D. (2021). Cyber-insurance in EU policy-making: Regulatory options, the market’s challenges and the US example. Comput. Law Secur. Rev., 43, 105627. https://doi.org/10.1016/j.clsr.2021.105627
Marotta, A., Martinelli, F., Nanni, S., Orlando, A., & Yautsiukhin, A. (2017). Cyber-insurance survey. Computer Science Review, 24, 35–61. https://doi.org/10.1016/j.cosrev.2017.01.001
Mihaela, M., Matei, M., & Năstasă, A. (2026). Exploring small business profiles in cybersecurity skills. 17(1), 87–110. https://doi.org/10.47743/ejes-2026-0104
Mueck, M. (2026). ETSI Activities in Artificial Intelligence and Data. 14, 255–258. https://doi.org/10.13052/jicts2245-800X.1425
Ning, D. (2026). Selection and Screening in Cyber Insurance Markets. SSRN Electronic Journal. https://doi.org/10.2139/ssrn.6147910
Nur, W., Wan, E., Ludin, M., Mohd, M., Fariza, W., & Fauzi, P. (2024). Comparative Analysis of Small and Medium-Sized Enterprises Cybersecurity Program Assessment Model. 15(8), 796–804.
Page, M. J., McKenzie, J. E., Bossuyt, P., Boutron, I., Hoffmann, T. C., Mulrow, C. D., Shamseer, L., Tetzlaff, J. M., Akl, E., Brennan, S. E., Chou, R., Glanville, J., Grimshaw, J. M., Hróbjartsson, A., Lalu, M. M., Li, T., Loder, E. W., Mayo-Wilson, E., McDonald, S., … Moher, D. (2021). The prisma 2020 statement: An updated guideline for reporting systematic reviews. Medicina Fluminensis, 57(4), 444–465. https://doi.org/10.21860/medflum2021_264903
Panaousis, E. (2023). Cyber Risk Assessment and Optimization : A Small Business Case Study. IEEE Access, 11(April), 44467–44481. https://doi.org/10.1109/ACCESS.2023.3272670
Paragioudakis, A., Komninos, N., Smyrlis, M., Spanoudakis, G., & Kloukinas, C. (2026). Risk management for cyber insurance: a survey for data-driven approaches with the use of AI. International Journal of Information Security, 25(4). https://doi.org/10.1007/s10207-026-01275-5
Pawar, S., Palivela, H., & Ph, D. (2022). International Journal of Information Management Data Insights LCCI : A framework for least cybersecurity controls to be implemented for small and medium enterprises ( SMEs ). International Journal of Information Management Data Insights, 2(1), 100080. https://doi.org/10.1016/j.jjimei.2022.100080
Perozzo, H., Ravarini, A., & Zaghloul, F. (2022). Assessing Cybersecurity Readiness within SMEs: Proposal of a Socio-Technical based Model. CEUR Workshop Proceedings, 3239, 22–32.
Perozzo, H., Zaghloul, F., & Ravarini, A. (2023). CyberSecurity Readiness : A Model for SMEs based on the Socio-Technical Perspective. 33, 53–66.
Qazi, A., Arshad, S., Ali, A., & Jadoon, K. (2026). Security evaluation framework for cloud ERP systems using NIST and ISO standards. 1–18.
Quispe-kobashikawa, G., Zuloaga-estrada, C., Mansilla-lopez, J., & Garcia-nunez, A. D. (2026). Enhancing Information Security in Technology Small and Medium-Sized Enterprises : A Metrics-Driven Model Based on ISO / IEC. 16(2), 34316–34326.
Rangu, C. M., Pană, N., & Șcheau, M. C. (2023). Cyber Risk Insurance Framework Considerations. In Contributions to Finance and Accounting: Vol. Part F1313 (pp. 383–401). Springer Nature. https://doi.org/10.1007/978-3-031-34082-6_15
Rawindaran, N., Jayal, A., & Prakash, E. (2025). Cybersecurity Framework : Addressing Resiliency in Welsh SMEs for Digital Transformation and Industry 5 . 0.
Rawindaran, N., Jayal, A., Prakash, E., Hewage, C., & Cf, C. (2023). International Journal of Information Perspective of small and medium enterprise ( SME ’ s ) and their relationship with government in overcoming cybersecurity challenges and barriers in Wales. International Journal of Information Management Data Insights, 3(2), 100191. https://doi.org/10.1016/j.jjimei.2023.100191
Romanosky, S., Ablon, L., Kuehn, A., & Jones, T. (2019). Content analysis of cyber insurance policies: How do carriers price cyber risk? Journal of Cybersecurity, 5(1). https://doi.org/10.1093/cybsec/tyz002
Shabbir, M. S., Karim, F., Zayed, N. M., Monir, S., Bipasha, M. S., Edeh, F. O., Alhebri, A., Jaradat, M., & Bansal, A. (2026). Cybersecurity Awareness among Women and Youth E-commerce Entrepreneurs in Bangladesh : An Exploratory Factor Analysis. 16(5), 333–346.
Skeoch, H., & Ioannidis, C. (2023). The barriers to sustainable risk transfer in the cyber-insurance market. J. Cybersecur., 10. https://doi.org/10.1093/cybsec/tyae003
Smyrli, D., Kakariaris, V., & Smyrlis, M. (2025). Cyber Insurance in Emerging European Markets: A Case Study of Greece and Cyprus. Proceedings of the 2025 IEEE International Conference on Cyber Security and Resilience, CSR 2025, 789–794. https://doi.org/10.1109/CSR64739.2025.11129995
Soquiat, M. M., Lumbera, M. L., & Abing, R. A. N. (2026). Fintech adoption as sustainable finance infrastructure : evidence from SMEs in Batangas province , Philippines. July, 1–6. https://doi.org/10.3389/fhumd.2026.1813050
Taskin, N., Özkeleş Yıldırım, A., Ercan, H. D., Wynn, M., & Metin, B. (2025). Cyber Insurance Adoption and Digitalisation in Small and Medium-Sized Enterprises. Information (Switzerland), 16(1). https://doi.org/10.3390/info16010066
Türen, S. H., Eustace, K., & Islam, R. (2026). Agile Resilience in Security for Small and Medium-Sized Businesses. 1–27.
Zhang, R., Zhu, Q., & Hayel, Y. (2017). A Bi-Level Game Approach to Attack-Aware Cyber Insurance of Computer Networks. IEEE Journal on Selected Areas in Communications, 35(3), 779–794. https://doi.org/10.1109/JSAC.2017.2672378
