Cyber security is getting more attention in the last decades. Unfortunately, the 100% cyber security protection is impractical and impossible, and therefore, we need to consider other cyber risk management strategies. One of them is cyber insurance, but its adoption has been slow in Europe and even more among SMEs. This thesis presents a qualitative study based on empirical data collection about the SMEs’ decision-making process to adopt cyber insurance. PMT is used as an underlying theory to build the interview questionnaire. The results show the different elements that make a company select this product or reject it. To the best of knowledge of the researcher, this is the first decision-making model for cyber insurance adoption focused on SMEs that has been done.
The model is unique in the way that it probes real behavior by SMEs when they are considering adopting cyber insurance and allows a dynamic use of it by showing the main stages as companies do not have the will to focus in the whole process but prefer to give a more significant weight to specific elements. Finally, the questionnaire used in this research could be used to gather additional data, which means, performing more interviews.