Cybersecurity Risk Management and Organisational Performance

The Moderating Role of Cybersecurity Mitigation Strategies in Saudi Insurance Companies

Abstract

Cybersecurity has become a strategic enterprise risk for insurers as digital transformation increases dependence on interconnected technologies and sensitive data. This study examines the relationships between cybersecurity risks and the perceived financial and operational performance of Saudi insurance companies and tests the moderating role of cybersecurity mitigation strategies. A quantitative cross-sectional survey was conducted among 150 professionals working in risk management, information technology, cybersecurity, internal audit, and related organisational functions. The proposed model was analysed using Partial Least Squares Structural Equation Modelling with SmartPLS 4.0. The results show that cybersecurity risks are negatively associated with perceived financial performance (β = −0.620, p < 0.001) and perceived operational performance (β = −0.580, p < 0.001). Cybersecurity mitigation strategies also significantly moderate both relationships. The positive interaction effects for perceived financial performance (β = 0.271, p < 0.001) and perceived operational performance (β = 0.298, p < 0.001) indicate that stronger governance, technological controls, employee awareness, regulatory compliance, and incident-response capabilities weaken the adverse performance consequences ofcybersecurity risks. The study contributes to Enterprise Risk Management and organisational resilience research by conceptualising cybersecurity mitigation strategies as integrated organisational capabilities rather than isolated technical controls. It also extends empirical cybersecurity research to the Saudi insurance sector. The findings highlight the importance of embedding cybersecurity governance, preparedness, and recovery capabilities within enterprise risk-management and business-continuity systems to support secure digital transformation.