Cybersecurity is a critical global challenge as organisations face increasingly sophisticated threats. While technical solutions remain essential, human decision-making plays a central role in determining cybersecurity outcomes. This study examines how individuals adopt cyberinsurance and protection measures, focusing on whether their decisions align with rational choice models. Using an online economic experiment with 4800 participants across four countries, we analyse purchasing behaviours and subsequent online security practices under varying scenarios of attack intentionality and pricing strategies. Our findings reveal that individuals deviate from expected utility maximisation, often choosing overprotective strategies with higher levels of insurance and security than economically optimal. We also find that contrary to concerns about moral hazard, insured individuals do not exhibit riskier behaviour post-adoption; instead, they maintain or enhance their security practices. Additionally, pricing mechanisms that link insurance premiums to protection levels promote more rational decision-making. These results highlight the interplay between human heuristics and cybersecurity strategies, suggesting that interventions must account for cognitive biases while designing effective cyberinsurance products and policies. This research contributes to the literature on behavioural economics in cybersecurity, offering insights into how decision-making frameworks can support more secure online environments.

We conducted an online experiment ( n = 2024) on a representative sample of internet users in Germany, Sweden, Poland, Spain and the UK to explore the effect of notifications on security behaviour. Inspired by protection motivation theory (PMT), a coping message advised participants on how to minimize their exposure to risk and a threat appeal highlighted the potential negative consequences of not doing so. Both increased secure behavior – but the coping message significantly more so. The coping message was also as effective as both messages combined, but not so the threat appeal. Risk attitudes, age and country had a significant effect on behavior. Initiatives seeking to promote secure behavior should focus more on coping messages, either alone or in combination with fear appeals.