Modeling and pricing cyber insurance

Abstract

The paper provides a comprehensive overview of modeling and pricing cyber insurance and includes clear and easily understandable explanations of the underlying mathematical concepts. We distinguish three main types of cyber risks: idiosyncratic, systematic, and systemic cyber risks. While for idiosyncratic and systematic cyber risks, classical actuarial and financial mathematics appear to be well-suited, systemic cyber risks require more sophisticated approaches that capture both network and strategic interactions. In the context of pricing cyber insurance policies, issues of interdependence arise for both systematic and systemic cyber risks; classical actuarial valuation needs to be extended to include more complex methods, such as concepts of risk-neutral valuation and (set-valued) monetary risk measures.

Managing Cyber Risk, a Science in the Making

“…Our focus in this section is on cyber risk. As there are already a few good surveys on it concentrating on business and actuarial sciences (Eling, 2020), or on actuarial models and pricing (Awiszus et al, 2022), we will select results about some issues that we find important so far, refering also to the state of the art given in , pointing out some research directions and their limitations. Complementary and more exhaustive information can be found in the cited surveys and in other papers.…”

“…Other legitimate ways of classifying the models exist in the literature, e.g. Awiszus et al (2022), Eling (2020), with some classes common to ours, which we discuss only when having additional points.…”

“…One of the characteristics of cyber risk is that it takes place in a wide network of computers and links, which makes it susceptible to be modelled using network (or graph) models, epidemiologic/pandemic models, or other adequate stochastic models. This class corresponding exactly to that of Awiszus et al (2022), we simply refer to their Sections 3.1 and 3.2.…”

“…Cyber risk is fundamentally different than natural catastrophes: It is man-made, so, studying the motivations of the attackers could be a way to look at the problem using game theory. The latter actors are not directly useful for pricing insurance, which may explain why hackers have not been taken into account in Marotta et al (2017), or Awiszus et al (2022) where this class of models is also suggested. Looking at hackers' motivation may be a useful study for governmental or legal entities too, to draw strategies and priorities to protect individuals or organizations.…”

“…By doing so, we would like to show how research on cyber risk is evolving and what are the main results obtained so far. In our work, three of the existing review papers on the topic will be helpful: Eling (2020) concentrates on the business and actuarial science literature, Awiszus et al (2022) on the modelling and pricing of cyber insurance, while Marotta et al (2017) provides a good overwiew on the cyber insurance market and economics, as well as research challenges. Other information taken from the media or the specialized press, conferences, discussions with cyber securities and insurance companies or within the ASTIN cyber working group, will also feed our exploration of this problem.…”