Hostname: page-component-77c78cf97d-sp94z Total loading time: 0 Render date: 2026-05-03T22:21:20.502Z Has data issue: false hasContentIssue false

Cyber-insurance pricing models

Published online by Cambridge University Press:  03 March 2025

James Bardopoulos*
Affiliation:
Institute and Faculty of Actuaries, London, UK Science Faculty, University of Cape Town, Western Cape, South Africa
Rights & Permissions [Opens in a new window]

Abstract

In the present technological age, where cyber-risk ranks alongside natural and man-made disasters and catastrophes – in terms of global economic loss – businesses and insurers alike are grappling with fundamental risk management issues concerning the quantification of cyber-risk, and the dilemma as to how best to mitigate this risk. To this end, the present research deals with data, analysis, and models with the aim of quantifying and understanding cyber-risk – often described as “holy grail” territory in the realm of cyber-insurance and IT security. Nonparametric severity models associated with cyber-related loss data – identified from several competing sources – and accompanying parametric large-loss components, are determined, and examined. Ultimately, in the context of analogous cyber-coverage, cyber-risk is quantified through various types and levels of risk adjustment for (pure-risk) increased limit factors, based on applications of actuarially founded aggregate loss models in the presence of various forms of correlation. By doing so, insight is gained into the nature and distribution of volatile severity risk, correlated aggregate loss, and associated pure-risk limit factors.

Information

Type
Contributed Paper
Creative Commons
Creative Common License - CCCreative Common License - BY
This is an Open Access article, distributed under the terms of the Creative Commons Attribution licence (https://creativecommons.org/licenses/by/4.0/), which permits unrestricted re-use, distribution, and reproduction in any medium, provided the original work is properly cited.
Copyright
© The Author(s), 2025. Published by Cambridge University Press on behalf of The Institute and Faculty of Actuaries
Figure 0

Table 1. Extant cyber-risk models. Distributions, models – green (recognised or plausible in the context of general insurance), orange (data dependent), red (unrealistic, misrepresentative), grey (out-of-scope, not applicable, unspecified)

Figure 1

Table 2. Costs (classes A–E) and possible coverage. Descriptions for classes A–E are based on “global” cost of data breach reports (Ponemon Institute, 2012i, 2013j, 2014f, 2013j); specimen products are purely illustrative examples of first-party coverage in respect of associated costs: AIG – Illinois (Murphy, 2013); ACE –(Cresenzi & Alibrio, 2016); Federal Insurance – (Daigle & Cresenzi, 2018)

Figure 2

Figure 1. Outline of theory and model links. Theory 1–4 (blue, in addition to risk theory which introduces 1 and 3); Models 4.1–4.6 (green; all models rely upon 1 and 2; 3 and 4 are only utilised in support of Models 4.3–4.6). Generated using Freemind (Müller et al., 2004).

Figure 3

Figure 2. Flow chart for Models 4.1–4.6. Models 4.4–4.5 and Model 4.6 assume correlated aggregate loss amounts and counts (classes A–D) respectively. Adjustments (e.g. inflation, risk) may apply to limit factors based on any of these models.

Figure 4

Table 3. FFT steps for ALDs (Models 4.3–4.6) (✓) if step is relevant, (x) otherwise

Figure 5

Table 4. Selected large-loss CDFs and splicing points. Threshold: dollar value of splicing point; Burr represents inverse Burr (i.e. Dagum CDF); CDFs fit using MLE to severities from Ponemon Institute (2012a–2012i, 2013a–2013j, 2014a–2014k, 2015, inflated to end of 2016

Figure 6

Table 5. Bootstrap results. 10k samples; selected % achieving minimum AICC; 90% confidence sets based on Kullback-Leibler distance estimate for selected CDF (colour coded font, A–E – average shape parameter for Weibull CDF selections). Tail-fit ratios (KS, AD – 5% critical); consistent ILFs (rate per 100). Underlying costs based on Ponemon Institute (2012a–2012i, 2013a–2013j, 2014a–2014k, 2015 inflated to 2016

Figure 7

Figure 3. ALDs: Model 4.3 Loss count: CRPoisson(10); IR – 10 (deterministic). Ponemon Institute (2012a–2012i, 2013a–2013j, 2014a–2014k, 2015) costs inflated to end of 2016. Per-loss limit ($20m, A-D).

Figure 8

Figure 4. ALDs: Models 4.3–4.6 $m; Scenarios 1–3: constant covariance coefficients of 0%, 5%, 10% resp., for Models 4.4 (IR) and 4.5 (CR). Loss count: Poisson(10) (Models 4.3–4.5, CR); MNB(10,1,0.09) for Model 4.6; IR: 10 (deterministic). Ponemon Institute (2012a–2012i, 2013a–2013j, 2014a–2014k, 2015) costs inflated to end of 2016. Per-occurrence limit (class E).

Figure 9

Table 6. Insurer ILF comparison (per-loss limits). Insurer comparison: 2016 ACE SERFF filing – Chubb Enterprise Risk Management Cyber and Digitech products (Cresenzi & Alibrio, 2016), with reference to (2015 year) SERFF filings by: AIG (Speciality Risk Protector) [AGNY-130104025], Travellers (Cyber-Essentials) [TRVD-130748646], Philadelphia (Cyber-Security Liability) [PHLX-G128091742], and ACE (MPL Advantage) [ACEH-125807939]. *$100m: ILFs estimated with Riebesell curve (implied at $10m limit). Base limit: $1m; retention: $10k. Shading: model range within insurer range (A:B)≔(min, max); partial if ranges overlap. “Median”: model ILF range. Ponemon Institute (2012a–2012i, 2013a–2013j, 2014a–2014k, 2015, inflated to end of 2016 (ILFs: adjusted to 2015)

Figure 10

Figure A.1. Identification of studies. Notes: (1) Search string: “ti:((cyber | information | interdependent) + (risk management | insur* | security)) kw: (model | empirical)” – which applies to titles (i.e. “ti”) and keywords (i.e. “kw”), through the UCT (n.d.) search engine; (2) English-only; identified Barracchini & Addessi (2014) from a similar (but excluded) Italian manuscript, ; (3) Full-text, peer-reviewed (re-included Soo Hoo (2000), Liu et al. (2007) – not peer-reviewed); (4) Period: 2000 – mid 2016; (5) 52 studies identified for full-text review by scanning titles, then abstracts, and introduced 11 new studies from online searches; references; and archived libraries (e.g. WEIS (2019); (6) eliminated 41 studies based on full-text review, leaving 22 for the model review. Motivated by Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) – (Moher et al., 2009), and Biener et al. (2015) search strategy for cyber-related losses.

Figure 11

Figure A.2. Overview of cyber-risk models. Text colour: common model types. Abbreviations: Bank for International Settlements [BIS] (2013); Honeypot – Pouget et al. (2005); ICSA: International Computer Security Association – Bridwell (2004); Ministry of Economy Trade Industry [METI] (2004); Operational Riskdata eXchange Association [ORX] (2017); SysAdmin, Audit, Admin and Security [SANS] (2019); World Development Indicators Database (WDID): World Bank (2019). SEIR: Susceptible-Exposed-Infected-Recovered, SIS: Susceptible-Infected-Susceptible. Note (1): undisclosed source.

Figure 12

Table B.1. Large-loss CDFs and scores. Final selections (percentiles: coloured font, A–E; CDFs: boxed) correspond to maximum overall scores (boxed). Weibull (shifted; asterisked: light-tailed), Burr (type III: Dagum), and Pearson: 3, 4, and 6 parameter CDFs respectively. Coloured bars: models – quantile divided by maximum (empirical severity); scores – relative magnitude. Criteria for (failing which, ): percentile deemed to be acceptable (in terms of ME plots); spliced CDF yields consistent ILFs over a given set of limits ($10k, $100m). Underlying costs: Ponemon Institute (2012a–2012i, 2013a–2013j, 2014a–2014k, 2015, inflated to 2016

Figure 13

Figure B.1. Empirical ME plots. Axes: x (threshold, $m), y (mean excess, values omitted as they are unnecessary for this exercise). Data: costs sourced from Ponemon Institute (2012a–2012i, 2013a–2013j, 2014a–2014k, 2015, inflated to 2016. Square markers (i.e. 94th, 96th, 93rd, and 92nd percentiles: A–D respectively) indicate the onset volatile or irregular trends (used as maximum percentiles for).

Figure 14

Table B.2. Discrete and continuous distributions. Limit l > 0 applies to random variable X for limited moments B.5–B.7 (Klugman et al., 2004, sec. A.2.1.1, A3.1.1). *Dagum is represented as Burr(b,c,d) – (i.e. a = 1) throughout the present research to align with Vose (2019) parameterisation of Burr (ordinarily d = 1 for Burr). Location parameter, for a shifted CDF, is included after other applicable parameters a-d (limited moments, B.5–B.7, based on need to be adjusted accordingly)

Figure 15

Figure B.2. Limit factor and gradient curves. Base limit: $100m. Risk margin (Model 4.3 (CR) in low (1–2), medium (3–4), and high environments achieve a risk margin of 5% at $10m, $100k, and $10k limits, respectively (based upon variance principle, which also applies to Models 4.5–4.6. PH transform applies to a compound Poisson-Weibull and lognormal CDF, fit to Ponemon Institute (2012a–2012i, 2013a–2013j, 2014a–2014k, 2015 costs, inflated to end of 2016). Loss count ∼ Poisson(10) (all CR models), and 10 (deterministic for Model 4.3 IR) Model 4.3 (IR).

Figure 16

Figure C.1. ALDs: Monte Carlo versus FFT (Model 4.3, CR) – (1) Left (of probability =0): MC simulation with 500k iterations; (2) Right: Model 4.3 (CR) with FFT (truncation, span) – A–D: ($96.2m, $23.5k), E: ($287.1, $70.1k). Limits: A–D ($20m), E ($80m); Poisson loss count with mean 10. Vertical axes – left (A–D); right (E). Underlying data: Ponemon Institute (2012a–2012i, 2013a–2013j, 2014a–2014k, 2015), costs inflated to year 2016.

Figure 17

Table C.1. Moments: Monte Carlo versus FFT. MC simulation with 500k iterations; Model 4.3 (CR) with FFT (truncation, span) – A–D: ($96.2m, $23.5k), E: ($287.1, $70.1k). Means: $m. Limits: A–D ($20m), E ($80m); Poisson loss count with mean 10. Underlying data based on Ponemon Institute (2012a–2012i, 2013a–2013j, 2014a–2014k, 2015, with costs inflated to end of 2016 year