Enhancing Cyber Security Resilience in Small to Medium Sized Enterprises (SMEs) Through Cyber Risk Management and Cyber Insurance

Small to Medium-sized Enterprises (SMEs) play a vital role in national and global economies, yet they remain disproportionately vulnerable to cyber threats due to limited resources, expertise, and formal risk management practices. While cyber insurance has emerged as a potential mechanism to transfer and manage cyber risk, SMEs frequently encounter difficulties in evaluating the suitability of cyber insurance for their specific operational contexts and how it aligns with their broader cyber security practices. This thesis addresses this challenge by developing a Decision Support Framework (DSF) to guide SMEs in making informed cyber insurance decisions within the broader context of cyber risk management. The research adopted a Design Science Research (DSR) methodology to develop and validate a practical artefact that supports SME decision-making. The study is structured through multiple research stages. First, a Systematic Literature Review (SLR) examines the existing body of knowledge on SME cyber security, cyber risk management, and cyber insurance, identifying key gaps and challenges in SME adoption and understanding of cyber insurance. Second, a large-scale content analysis of cyber insurance proposal forms evaluates how insurers assess cyber security practices, mapping insurer requirements against recognised security frameworks. Third, qualitative interviews with SMEs, insurers, brokers, and cyber security practitioners explore real-world perceptions, barriers, and decision-making behaviours related to cyber insurance. Insights from these studies inform the design and development of a Decision Support Framework implemented as an interactive decision tree intended to simplify complex cyber risk and insurance considerations for SME decision-makers. The framework is validated through stakeholder interviews to assess its usability, relevance, and practical value. The findings contribute to both research and practice. Academically, the study advances understanding of SME cyber risk decision-making and the role of cyber insurance within organisational risk management. Practically, it offers a structured and accessible tool that can help SMEs assess cyber insurance in a way that complements, rather than substitutes, effective cyber security practices.