Exact Insurance Premiums for Cyber Risk of Small and Medium-Sized Enterprises

Abstract

As cyber attacks have become more frequent, cyber insurance premiums have increased, resulting in the need for better modeling of cyber risk. Jevtic and Lanchier[20] proposed a dynamic structural model of aggregate loss distribution for cyber risk of small-and-medium-sized enterprises under the assumption of a tree-based local-area-network topology that consists of the combination of a Poisson process, homogeneous random trees, bond percolation processes, and cost topology. Their model assumes that the contagion spreads through the edges of the network with the same fixed probability in both directions, thus overlooking a dynamic cyber security environment implemented in most networks, and their results give an exact expression for the mean of the aggregate loss but only a rough upper bound for the variance. In this paper, we consider a bidirectional version of their percolation model in which the contagion spreads through the edges of the network with a certain probability moving toward the lower level assets of the network but with another probability moving toward the higher level assets of the network. Also, our different mathematical approach leads to exact expressions for both the mean and the variance of the aggregate loss, and therefore an exact expression for the insurance premiums.

Framework for cyber risk loss distribution of hospital infrastructure: Bond percolation on mixed random graphs approach

“…In this setting, there have been works for cyber risk such as using epidemic models (e.g., Xu & Hua, 2019; Antonio & Indratno, 2021), Bayesian models (e.g., Amin, 2019; Zebrowski et al., 2022), and attack graphs (e.g., S. Wang et al., 2013; H. Wang et al., 2018). The works more relevant to our proposed framework are Jevtić and Lanchier (2020), who proposed a structural model of aggregate loss distribution for cyber risk using bond percolation, and Chiaradonna and Lanchier (2022), who considered a bidirectional version of their model. And despite the lack of actuarial literature on the cyber risk of a hospital, these models pave the way for taking a network approach for pricing cyber risk and thus quantifying potential financial losses for risk frameworks.…”