Abstract
Cyber risk has evolved from a niche operational hazard into one of the most consequential and least tractable classes of insurable risk. Insurers continue to rely largely on heuristic and experience-rated underwriting, while the academic literature has produced a rapidly expanding but fragmented body of quantitative models. This review synthesises the peer-reviewed literature on cyber risk quantification and cyber insurance pricing, drawing on a structured search of scholarly databases that returned 199 records, from which 102 studies are critically reviewed. The literature is organised into eight themes: the statistical properties of cyber losses; actuarial and mathematical pricing models; dependence modelling and systemic risk; machine-learning approaches to incident prediction and underwriting; technical risk-assessment frameworks and control-based premium adjustment; the economics of cyber insurance markets; sectoral heterogeneity in cyber exposure; and methods for modelling under data scarcity. Across themes, four persistent findings emerge: cyber losses are heavy-tailed and dynamically non-stationary; dependence among losses undermines classical portfolio diversification and is systematically under-modelled in practice; technical vulnerability metrics and financial loss models remain poorly integrated; and virtually all empirical evidence derives from United States loss databases, leaving emerging markets and firm-level primary data almost unexamined. These gaps motivate an integrated, industry-specific research agenda that couples asset-centric technical assessment (CVSS, FAIR, ISO/NIST alignment) with neural-network incident probability estimation, copula-based dependence modelling and explicit actuarial premium construction. The review concludes by positioning such a framework against the state of the art and identifying the contribution it would make to actuarial science, underwriting practice and regulation.