Bishwa Bhusal

As the rapid evolution and expansion of Internet of Things (IoT) devices continues to accelerate, modern infrastructures face increasing cyber risks, largely driven by device inter-connectivity, limited security maturity, and interdependent attack propagation across networks. Traditional cyber insurance models often overlook these IoT-specific characteristics, relying on uniform or simplified risk assumptions that fail to capture real-world vulnerabilities. To address this gap, this paper presents a maturity-aware cyber insurance optimization framework tailored for interconnected IoT environments. The framework integrates organizational security maturity, interdependent risk propagation modeled through a modified Susceptible–Infected–Susceptible (SIS) process, and a Stackelberg game formulation that captures strategic interactions between the insurer and the defender. Through numerical studies on representative IoT topologies, we demonstrate that maturity-aware, risk-sensitive premium structures quantitatively outperform uniform pricing baselines in cost-efficiency and insurer sustainability. Specifically, our experimental results reveal that operating at an optimal intermediate maturity level ($M=3$) reduces the defender’s total expected cost by approximately $40\%$ (from $255.38$ k to $152.36$ k) compared to the baseline state ($M=1$). Furthermore, this structural hardening triggers an $88.3\%$ reduction in full-coverage insurance premiums (from $225.38$ k to $26.36$ k). In contrast, our uniform-pricing baseline exhibits reduced profitability in our experiments due to cross-subsidization effects, reinforcing the value of tiered, risk-proportional pricing for mitigating adverse-selection incentives. In summary, this work establishes a tractable, economically viable framework for cyber insurance in IoT ecosystems and provides a foundation for future extensions to richer network settings.