A Game-Theoretic Framework for Cyber Governance in a World of Persistent Threat
Marilyn Sithole ORCID ↗ · Odette Swart ORCID ↗
International Journal of Business Ecosystem & Strategy · 2026 · Vol. 8 / Issue 6 · 421-436
Publication metrics
External links open provider records or DOI searches. Provider counts are not combined. Mendeley readership measures saves, not citations.
Dimensions
Live provider badge. If unavailable, use the Dimensions link above.
Observed Not yet retrieved
OpenAlex and Mendeley observations refresh on article visits, at most once per 24 hours. Unavailable data is not zero. Google Scholar opens a DOI search.
Citations received by this article, grouped by the year of the citing work. Crossref and OpenAlex lifetime totals remain separate in Publication metrics.
Annual citation history is not available for this article yet. No annual values have been assumed to be zero.
Annual history last updated: not yet retrieved. The history is fetched with OpenAlex metrics on eligible article visits and during the scheduled OpenAlex refresh.
Abstract
The paper identifies the problem that traditional cybersecurity approaches overemphasise technical vulnerabilities and isolated risk management, while overlooking the strategic and institutional dynamics that shape cyber risk outcomes. Its purpose is to propose a game-theoretic framework for cyber governance that reconceptualises cyber risk as the equilibrium outcome of interactions among threat actors, SMEs, regulators, insurers, and assurance providers. The study uses a conceptual method grounded in game theory and institutional analysis, integrating strategic interaction, signalling theory, repeated games, and bounded rationality to model cyber governance as an adaptive multi-actor system. The results show that governance structures shape attacker and defender incentives by altering payoff structures through regulation, assurance, and oversight, while information asymmetries, signalling, and repeated interactions produce persistent equilibrium outcomes. It further finds that governance interventions such as transparency, compliance, and proactive signalling can shift systems toward more secure equilibria and reduce moral hazard, particularly for SMEs operating under uncertainty. The paper concludes that cyber risk is fundamentally an institutional and strategic outcome rather than a purely technical issue, contributing a game-theoretic governance framework that integrates institutional design, information asymmetry, and risk management to inform policymakers, assurance providers, and decision-makers seeking improved cybersecurity resilience.
Keywords: {'name': 'Cyber governance, cyber risk, game-theoretic framework, SMEs, ethics, information asymmetry'}
Authors & affiliations
Marilyn Sithole
Affiliation not supplied
Odette Swart
Affiliation not supplied
Deposited references
Supplied references, not a list of publications citing this article.
No reference list supplied.