Risk transfer shifts financial consequences to a third party — cyber insurance (covers breach costs), contracts with SLA and liability clauses, outsourcing to managed service providers with security SLAs.
Insurance covers financial consequences but NOT the reputation damage, regulatory fines (mostly), or technical remediation. Cyber insurance requires minimum security controls for coverage. Review exclusions — many policies exclude nation-state attacks or unpatched known vulnerabilities.