AI-Informed Cyber Risk Governance: An Expected Loss Optimisation Framework for RMF Adoption in Mid-Sized Enterprises

Cybersecurity incidents increasingly generate substantial operational and financial losses, which require organisations to adopt governance approaches that support both risk control and economic decision-making. While the Risk Management Framework (RMF) is widely recognised as a structured mechanism for managing cybersecurity risks, limited research has examined its economic value and the organisational determinants of its adoption. This study addresses this gap by investigating RMF adoption in mid-sized software enterprises from an expected-loss optimisation perspective.

The research integrates evidence from four large-scale industry sources—the Stack Overflow Developer Survey, ENISA Threat Landscape Reports, OpenSSF Secure Practices Survey, and Verizon Data Breach Investigations Report (DBIR). Using descriptive analytics, exploratory factor analysis, binary logistic regression, and hypothesis testing, the study evaluates the organisational factors influencing RMF adoption and assesses its impact on mitigating cyber risks.

The findings reveal a significant disconnect between RMF awareness and implementation, indicating that technical knowledge alone is insufficient to achieve effective risk governance. Leadership support emerges as the most influential organisational factor. The absence of leadership commitment represents the strongest barrier to adoption (loading = −0.58), whereas executive endorsement significantly increases the likelihood of RMF implementation (β = 1.1671, p < .001). Organisations adopting RMF demonstrate measurable operational benefits, including a 40% improvement in threat detection capability and a 66% reduction in incident response time.

To extend existing RMF literature, the study develops an expected-loss evaluation model that links cybersecurity governance with risk economics by representing cyber risk as a combination of breach probability and loss severity. The analysis indicates that effective RMF implementation can reduce expected cyber loss by approximately 60–70%, transforming RMF from a compliance-orientated practice into a quantifiable risk-reduction investment. The proposed framework contributes a novel decision-support perspective for evaluating cybersecurity governance and offers practical guidance for enhancing cyber resilience and organisational risk efficiency.