2. Related work and advancements

Cyber insurance plays a critical role in an organization’s portfolio of mitigation measures, making the interactions between insurers and insureds a key component of a cybersecurity investment strategy. However, this aspect is often overlooked in the cybersecurity economics literature, which primarily focuses on selecting controls to mitigate system vulnerabilities. For example, models for the optimal selection of cybersecurity controls include Smeraldi and Malacaria (Reference Smeraldi and Malacaria2014), who explore how to spend a security budget optimally by employing methods that address overlapping controls that exhibit nonlinear relationships, such as optimization algorithms, combinatorial optimization, and the classical Knapsack problem. Fielder et al. (Reference Fielder, Panaousis, Malacaria, Hankin and Smeraldi2016) propose a methodology for investing in such controls, considering a single value for a vulnerability and several implementation levels for each control. The latter align with the information security levels introduced in the seminal work of Gordon and Loeb (Reference Gordon and Loeb2002).

Building on prior work by Almohri et al. (Reference Almohri, Watson, Yao and Ou2016), Khouzani et al. (Reference Khouzani, Liu and Malacaria2019) develop a game-theoretic framework for analyzing defender-attacker interactions. In this framework, the defender chooses a plan to minimize security risk, while the attacker aims to maximize it by exploiting the most effective attack path. This is modeled as a min–max optimization problem, where the attacker maximizes and the defender minimizes in response to the attacker’s action. Additionally, Zheng et al. (Reference Zheng, Albert, Luedtke and Towle2019) cast the problem of optimal control selection as a set covering problem. They first solve a deterministic version to examine incentives for mitigating supply chain vulnerabilities and later introduce constraints and uncertainties in control efficacy. Expanding on Fielder et al. (Reference Fielder, Panaousis, Malacaria, Hankin and Smeraldi2016), Panda et al. (Reference Panda, Panaousis, Loukas, Laoudias, Di Pierro, Malacaria and Nagarajan2020) propose an optimal control set for protecting healthcare employee groups from social engineering attacks. However, a limitation of these optimization models is their failure to account for the serial nature of an attack and critical uncertainties, such as the exploitation time of a vulnerability and the associated costs once it is compromised. As a result, these models often overlook the financial implications of such uncertainties on an organization’s assets.

Game-theoretic models that analyze interactions between insurers and insureds include Grossklags et al. (Reference Grossklags, Christin and Chuang2008), Laszka et al. (Reference Laszka, Panaousis, Grossklags, Bushnell, Poovendran and Başar2018), and Wang (Reference Wang2019). Specifically, Laszka et al. (Reference Laszka, Panaousis, Grossklags, Bushnell, Poovendran and Başar2018) employ a two-player signaling game to address information asymmetry between a potential client and an insurer, studying incentives for auditing clients before calculating cyber insurance premiums. In the same line of work, Wang (Reference Wang2019) examines the optimization of a firm’s cybersecurity investment decision, whereby a firm must determine how much to invest in both knowledge and expertise, as well as in mitigation measures. The findings indicate that the effectiveness of security spending on specific threats may be diminished if other interdependent security measures are not simultaneously implemented. Insights on how cyber insurance may contribute to risk-reduction training are also provided; however, cyber insurance is not directly integrated into the problem of optimal capital allocation. Similarly, Chong et al. (Reference Chong, Feng, Hu and Zhang2025) emphasize the importance of conducting comprehensive cost–benefit analyses for budget-constrained firms that must make informed capital allocation decisions to achieve a balanced cyber risk management strategy, effectively integrating cybersecurity investment, insurance coverage, and reserving.

Further complicating the strategic interaction between insurers and insureds is information asymmetry, whereby the two parties do not have access to the same information. Within the context of cyber security and cyber insurance, the insurer may lack information regarding the applications and software products installed by network users, as well as regarding the users’ network usage habits (Moore, Reference Moore2010; Böhme, Reference Böhme2010; Pal et al., Reference Pal, Golubchik, Psounis and Hui2014). There are many obstacles for an insurer in obtaining reliable information about the risk exposure of an insured, and even more obstacles in ensuring that this exposure is maintained at the specified level throughout the policy period. For instance, Pal (Reference Pal2012) addresses information asymmetry in cyber insurance by analyzing three distinct scenarios: mutual ignorance, where neither the insured nor the insurer has information about the insured’s cybersecurity investment level; post-contract information acquisition, in which the insurer lacks initial information but the insured gains it after signing the contract; and pre-contract information acquisition, where the insurer remains uninformed while the insured obtains relevant details before entering the contract. In our paper, we explore a critical understudied type of information asymmetry in cyber insurance: the insured has no way of knowing how risk-averse the insurer actually is. This can create a mismatch between what the defender believes about the insurer’s risk attitude and the insurer’s true level of risk aversion.

While the aforementioned literature considers risk mitigation through both cybersecurity measures and cyber insurance, the insurer’s decision-making, which in turn influences a company’s optimal cybersecurity investment, is often overlooked. This gap is addressed by Zhang and Zhu (Reference Zhang and Zhu2022), who develop a Markov model to capture the cyber risk dynamics and defender decisions regarding mitigation measures, including both controls and cyber insurance. In this framework, defenders receive financial compensation from insurers for losses caused by cyber attacks in exchange for premiums. The defenders’ objective is to deploy an optimal combination of controls and cyber insurance to minimize losses, favoring contracts with low premiums and high coverage. Conversely, insurers tend to offer contracts with high premiums and low coverage to maximize profits. Similar to traditional insurance, insurers lack knowledge of local protections implemented by defenders, which can result in inappropriate insurance contracts that significantly harm insurers’ profitability.

Our work builds upon three key strands of literature: first, the valuation of serial projects to assess security breach risks progressing in phases (Tsiodra et al., Reference Tsiodra, Panda, Chronopoulos and Panaousis2023); second, the modeling of the optimal level of resources for securing information (Gordon & Loeb, Reference Gordon and Loeb2002); and third, the strategic interactions between a defender and an insurer, as explored by Zhang and Zhu (Reference Zhang and Zhu2022). Our contribution is thus threefold. First, we extend the traditional discounted cash flow approach by accounting for key uncertainties and the impact of security upgrades on the likelihood of successful attacks. In doing so, we enhance the framework’s applicability not only for investment decision-making but also for risk assessment and management in a cybersecurity context. Second, we develop a bi-level model that captures the strategic interactions between the defender and the insurer. This allows the insureds’ decision-making to depend on the insurers’ choices, and vice versa, reflecting the interdependent nature of their strategies. Third, by analyzing the trade-off involved in allocating a finite budget between controls and cyber insurance, we derive endogenous strategies for both parties.

Our findings indicate that the insurance company tends to offer higher coverage when it receives a larger premium. However, this tendency also depends on the effectiveness of system upgrades. For instance, if a small investment in system upgrades significantly reduces claim frequency, the insurer might be willing to provide high coverage even with a lower premium. Conversely, when the projected frequency of cyber attacks is high, the insurer is inclined to offer lower coverage. In such cases, the defender may find it more advantageous to allocate more capital to system upgrades rather than to insurance. Interestingly, the effectiveness of system upgrades can have a non-monotonic influence on the equilibrium budget allocation strategy and insurance contract design, i.e., greater system upgrade effectiveness does not necessarily imply that the firm should allocate more resources toward them.

3. Model framework

3.1 Preliminaries

Let the defender’s infrastructure consist of $n\in \mathbb{N}$ systems and networks, referred to as assets, that can be compromised by potential hackers (attackers). Each asset $i\in \mathbb{N}$ has $m_i\in \mathbb{N}$ vulnerabilities, that is, software weaknesses (see https://cwe.mitre.org/index.html) that the attacker may exploit. This reflects real-world attacker behavior, where adversaries aim to penetrate as deeply into a network as possible to maximize their expected return from an attack.

These strategic interactions are modeled as a sequence of attack phases, where phase $i$ of an attack refers to the stage in which the attacker aims to compromise asset $i$ by exploiting any of its $m_i$ vulnerabilities, as illustrated in Figure 1. In each phase, the attacker can compromise at most one asset, with successful exploitation potentially leading to privilege escalation or lateral movement within the defender’s infrastructure (Niakanlahiji et al., Reference Niakanlahiji, Wei, Alam, Wang and Chu2020).

The expected impact on the defender from the exploitation of asset $i$ is denoted by $L_{i}$ . Following standard risk assessment principles Whitman and Mattord (Reference Whitman and Mattord2011), $L_{i}$ is expressed in terms of attack likelihood, compromise probability, and loss magnitude. Specifically,

(1) \begin{equation} L_{i}=A_{i}\cdot \langle R_{i},S_{i}\rangle , \end{equation}

where $A_{i}$ denotes the value of asset $i$ , $R_{i}$ is an $m_i$ -dimensional vector of likelihoods that the attacker attempts to exploit the $m_{i}$ vulnerabilities of asset $i$ , and $S_{i}$ is an $m_i$ -dimensional vector of probabilities that each vulnerability is successfully breached. The inner product $\langle R_{i},S_{i}\rangle$ thus represents the overall likelihood of a successful attack against asset $i$ .

The defender has the option of distributing budget $K$ between enhancing the system and purchasing cyber insurance at time $0$ . More specifically, the defender invests $wK$ , for $w\in [0,1]$ , in a system upgrade and $(1-w)K$ in cyber insurance. The former aims to decrease the likelihood of cyber attacks, while the latter offers coverage for a fraction $c\in [0,1]$ of future losses stemming from such attacks, where $c$ is determined endogenously by the insurer (see Section 3.2). The time at which the loss, $L_i$ , of the $i$ th attack is incurred is

(2) \begin{equation} T^w_i=\sum _{j=1}^{i}\tau ^w_j, \end{equation}

where $\tau ^w_j$ is the $j$ th random inter-attack duration with probability distribution generally denoted by $G(\!\cdot \!)$ (identical for all $j$ ).

Figure 1

Sequential security breach.

The insurer determines the coverage level, $c^*(w)$ , based on the capital $(1-w)K$ , the defender invests in insurance. Given the specifics of the insurance contract, the defender sets optimally the equilibrium budget allocation strategy, $\widetilde {w}$ , with corresponding equilibrium coverage level

\begin{equation*} \widetilde {c}=c^{\ast }\left ( \widetilde {w}\right ) . \end{equation*}

Our framework can accommodate general duration probability distributions. Consistent with Bentley et al. (Reference Bentley, Stephenson, Toscas and Zhu2020), we adopt the intuitive compound Poisson process with arrival intensity $\lambda$ to model the impact of mitigations on attack frequency. Following a system upgrade, the likelihood of successful cyber attacks diminishes, and the arrival intensity becomes $f(w)\lambda$ , where $0 \lt f(\!\cdot \!) \lt 1$ depends on the invested funds. Aligning the mitigation models discussed in Gordon and Loeb (Reference Gordon and Loeb2002) with our context yields

(3) \begin{equation} f(w) = \frac {1}{(aw + 1)^b}, \end{equation}

where $a \gt 0$ and $b \geq 1$ are parameters associated with the capital invested in system upgrades. A higher value of $a$ or $b$ represents greater effectiveness of the system upgrade.

3.2 Equilibrium analysis

This section presents the analytical framework within which the objectives of the defender and the insurer are combined to yield equilibrium decisions regarding investment in system upgrades and insurance coverage. A diagrammatic overview of the bi-level framework and the resulting equilibrium is provided in Figure 2. First (Level 1), we formulate the defender’s value function, which we use to derive the capital $w^*(c)$ to be invested in system upgrades. Second (Level 2), the insurer determines the coverage amount $c^*(w)$ . This is then passed as input to $w^*(c)$ to produce the equilibrium investment $\widetilde {w} \equiv w^*(c^*)$ in system upgrades and the equilibrium coverage level $\widetilde {c} \equiv c^*(\widetilde {w})$ .

Figure 2

Diagrammatic representation of the bi-level framework capturing the strategic interaction between the defender and the insurer.

As set out in the previous section, the defender may choose to allocate $wK$ to a system upgrade and $(1-w)K$ to purchasing cyber insurance. This allocation provides coverage for a portion of future losses resulting from cyber attacks. In the event that the defender incurs loss $L_{i}$ , the insurer reimburses $cL_{i}$ , where $c\in \lbrack 0,1]$ ; $c=0$ corresponds to no coverage, while $c=1$ to full coverage. The defender’s PV of loss in phase $i = 1, 2, 3, \dots , n$ is

\begin{equation*} V_i(w) = (1-c)L_{i}e^{-rT_{i}^{w}}. \end{equation*}

Since the arrival of attacks follows a Poisson process, the time intervals between successive attacks are exponentially distributed, i.e., $\tau _{j}^{w}\sim \mathrm{Exponential}(f(w)\lambda )$ , hence $T_{i}^{w}\sim \mathrm{Gamma}(i,f(w)\lambda )$ (see equation 2). The distributional properties of the resulting discounted loss $V_i(w)$ are derived in the Appendix. Therefore,

(4) \begin{eqnarray} \mathbb{E} [V_i(w)]&=& (1-c)L_i \prod _{j=1}^{i} \mathbb{E}\left [e^{-r\tau _j^w}\right ]= (1-c)L_i \left (\frac {f(w)\lambda }{f(w)\lambda + r}\right )^i. \end{eqnarray}

The PV over all losses is

(5) \begin{equation} V(w)= (1-c)\sum _{i=1}^{n}L_{i}e^{-rT_{i}^{w}}, \end{equation}

with expectation

(6) \begin{eqnarray} \mathbb{E}\left [ V(w)\right ] &=& (1-c)\sum _{i=1}^{n}L_{i}\left ( \frac {f(w)\lambda }{f(w)\lambda +r}\right ) ^{i}. \end{eqnarray}

The defender’s optimization problem is to derive the value of $w$ that minimizes the expected loss for a given $c$ :

(7) \begin{eqnarray} w^{*}(c)=\mathop {\mathrm{argmin}}\limits _{w\in [0,1]} \mathbb{E}\left [V(w)\right ]. \end{eqnarray}

On the other hand, the insurer focuses on designing cyber insurance contracts. The insurer’s profit is the premium revenue minus the losses ceded by the firm due to cyber attacks. Specifically, the insurer receives $(1-w)K$ at time $0$ , but incurs a cost $cL_i$ when the firm experiences a loss $L_i$ due to a cyber attack. The PV of the insurer’s profit is given by

(8) \begin{eqnarray} S(w) = (1-w)K - c \sum _{i=1}^{n} L_i e^{-rT_i^{w}} . \end{eqnarray}

From (8), the PV of the insurer’s profit depends on the firm’s budget allocation plan $w$ . In response, the insurer determines the level of coverage $c$ based on the premium received. Here, we assume that the insurer is risk-averse and seeks to achieve a positive profit from the insurance contract with probability $\alpha _{ins}$ , i.e.,

\begin{align*} \mathbb{P}(S \gt 0) = \alpha _{ins}. \end{align*}

The confidence level $0 \leq \alpha _{ins} \leq 1$ reflects the insurer’s degree of risk aversion, with a larger (smaller) $\alpha _{ins}$ indicating a more (less) conservative insurer. This condition implies that the premium exceeds the cost of insurance coverage with probability $\alpha _{ins}$ . Therefore, the insurer’s required level of coverage satisfies

\begin{equation*} {(1-w)K = \inf \left \{ z \in \mathbb{R} \,:\, \mathbb{P}(Z(w) \leq z) \geq \alpha _{ins} \right \} = \textrm {VaR}_{\alpha _{ins}}(Z(w)), } \end{equation*}

where ${Z(w)} = c \sum _{i=1}^{n} L_i e^{-rT_i^{w}}$ and the Value-at-Risk (VaR) measures the risk by examining the left tail of the PV distribution and is positively homogeneous. Without loss of generality, we adopt VaR as our risk measure, though this choice is not restrictive, and alternative risk measures or utility functions may be employed. By positive homogeneity of VaR, i.e., $\mathrm{VaR}_\alpha (cX)=c\,\mathrm{VaR}_\alpha (X)$ for $c\gt 0$ , and rearranging (3.2), we obtain the insurer’s required level of coverage as a function of $w$ :

(9) \begin{eqnarray} c^*(w) &=& \frac {(1-w)K}{\mathrm{VaR}_{\alpha _{ins}}\!\left (\sum _{i=1}^{n} L_i e^{-rT_i^{w}}\right )} . \end{eqnarray}

Next, given the required coverage level $c^*(w)$ , we determine the PV of the firm’s losses, now taking into account the firm’s perception of the insurer’s level of risk aversion, reflected in $\alpha _{def}$ , which may differ from the insurer’s actual level of risk aversion $\alpha _{ins}$ due to information asymmetry. By substituting (9) into (5), the PV of the firm’s loss becomes

(10) \begin{eqnarray} V^*(w)=\left (1-\frac {(1-w)K}{\mathrm{VaR}_{\alpha _{def}}\left (\sum _{i=1}^{n}L_ie^{-rT_i^{w}}\right )}\right ) \sum _{i=1}^{n}L_ie^{-rT_i^{w}}. \end{eqnarray}

The equilibrium budget allocation strategy then follows as

(11) \begin{eqnarray} \widetilde {w}=\mathop {\mathrm{argmin}}\limits _{w\in [0,1]} \mathbb{E} \left [V^*(w)\right ]. \end{eqnarray}

Finally, the equilibrium insurance coverage is obtained as

\begin{align*} \widetilde {c} = c^{*}\!\left (\widetilde {w}\right ). \end{align*}

4. Numerical analysis of equilibrium strategies

This section explores the effects of budget allocation ratios, attack frequency, and the frequency reduction parameter on the equilibrium strategies of a defender and an insurer. We examine how these factors influence the insurance coverage level and the expected PV of losses. We highlight the interplay between system upgrades and insurance, revealing non-monotonic relationships and strategic trade-offs that arise from variations in attack frequency and system upgrade effectiveness.

We begin by exploring how the allocation of resources between system upgrades and cyber insurance influences key outcomes, such as insurance coverage levels and expected losses. Table 1 presents the impact of the exogenous budget allocation ratio $w$ on the optimal investment in insurance coverage, the expected PV of losses retained by the defender, and the VaR of losses transferred to the insurer. For illustrative purposes, results are based on the parameter values $n=150$ , $r=0.1$ , $K=5$ , $L_i=1$ , $a=0.5$ , $b=1$ , and $\alpha _{ins} = \alpha _{def} = \alpha =0.95$ , using 10 million simulation runs.Footnote ² For example, when $a=0.5$ , the insurer provides higher coverage as the premium $(1-w)K$ increases. However, this increased insurance coverage does not necessarily lead to smaller losses from cyber attacks for the firm. In fact, we observe a non-monotonic relationship with $w$ , particularly for high attack frequencies (see cases $\lambda =1$ or $2$ ).

Table 1.

Impact of the budget allocation ratio $w$ on the optimal insurance coverage level, the expected PV of losses retained by the defender, and the vaR of losses ceded to the insurer, where $Z(w) = c^*(w)\sum _{i=1}^n L_i e^{-rT_i^w}$

Table 2 reports the equilibrium budget allocation ratio $\widetilde {w}$ , insurance coverage level $\widetilde {c}$ , and expected PV of losses $\widetilde {V}(\!\cdot \!)$ , under information asymmetry. Specifically, this asymmetry is reflected in differing percentile levels used in the calculation of the VaR. In the upper panel, we hold constant the defender’s perception of the insurer’s risk aversion, i.e., $\alpha _{def} = 0.95$ , while increasing the insurer’s actual level of risk aversion. The results show that the defender’s expected losses increase as $\alpha _{ins}$ rises. Intuitively, under information asymmetry, the defender forms decisions based on a fixed belief about the insurer’s risk aversion and therefore does not observe the insurer’s true level. As a result, the defender maintains a constant budget allocation ratio $\widetilde {w}$ . In contrast, the insurer’s behavior reflects its true level of risk aversion: the more risk-averse the insurer is relative to the defender’s perception, the lower the equilibrium coverage level. For example, when $\lambda =1$ , the defender consistently allocates $\widetilde {w}=0.35$ of the budget to system upgrades regardless of $\alpha _{ins}$ , yet the coverage level falls from $\widetilde {c}=0.2897$ to $0.2849$ to $0.2532$ as $\alpha _{ins}$ rises from $0.90$ to $0.95$ to $0.975$ , with expected losses increasing correspondingly from $6.0449$ to $6.2226$ to $6.3731$ .

Table 2.

Equilibrium investment, coverage, and expected PV under asymmetric information

The lower panel of Table 2 isolates the impact of information asymmetry when the insurer’s risk aversion level is held fixed, but the defender does not observe its exact value. We find that when the cyberattack frequency is either very low or very high (e.g., $\lambda \leq 0.5$ or $\lambda \geq 2$ ), the expected losses are identical across all values of $\alpha _{def}$ . This occurs because $\widetilde {w}$ remains constant, indicating that it is optimal for the defender to allocate the entire budget either to system upgrades or to purchasing insurance. When $\lambda$ takes intermediate values, however, the defender’s expected PV of losses is minimized under symmetric information, i.e., when $\alpha _{def} = \alpha _{ins}$ , and increases as $\alpha _{def}$ deviates from $\alpha _{ins}$ . This arises because information asymmetry leads the defender to choose a suboptimal budget allocation, resulting in higher realized losses relative to the symmetric-information benchmark. For example, when $\lambda =1$ and $\alpha _{ins}=0.95$ , the defender optimally sets $\widetilde {w}=0.35$ under symmetric information, yielding $\widetilde {V}=6.2226$ . If instead the defender underestimates the insurer’s risk aversion ( $\alpha _{def} = 0.90$ ), the budget allocation falls to $\widetilde {w}=0.25$ , raising expected losses to $\widetilde {V}=6.2289$ . Conversely, overestimating the insurer’s risk aversion ( $\alpha _{def}=0.975$ ) leaves $\widetilde {w}$ unchanged at $0.35$ but results in miscalculated coverage, pushing $\widetilde {V}$ to $6.2343$ .

Turning to the directional patterns in Table 2, in the upper panel, $\widetilde {w}$ is invariant to $\alpha _{ins}$ across all $\lambda$ , since the defender does not observe the insurer’s true risk aversion and therefore cannot condition on it. The equilibrium coverage $\widetilde {c}$ , however, is decreasing in $\alpha _{ins}$ : a more risk-averse insurer demands a higher VaR threshold before committing to coverage, so for any given premium, the coverage offered is lower. Consequently, $\widetilde {V}$ is increasing in $\alpha _{ins}$ for intermediate $\lambda$ , and remains constant for $\lambda =2$ , where $\widetilde {w}=1$ and no insurance is purchased regardless. In the lower panel, $\widetilde {w}$ is non-decreasing in $\alpha _{def}$ for intermediate $\lambda$ : a defender who overestimates the insurer’s risk aversion anticipates less coverage being offered and therefore shifts more of the budget toward system upgrades. The coverage $\widetilde {c}$ is correspondingly decreasing in $\alpha _{def}$ , since a higher $\widetilde {w}$ reduces the premium $(1-\widetilde {w})K$ available to the insurer, mechanically lowering the coverage level. For $\lambda =0.5$ and $\lambda =2$ , the corner solutions ( $\widetilde {w}=0$ and $\widetilde {w}=1$ , respectively,) are robust to misspecification of $\alpha _{def}$ , so both $\widetilde {c}$ and $\widetilde {V}$ remain constant across columns. The behavior of $\widetilde {V}$ for intermediate $\lambda$ is non-monotone in $\alpha _{def}$ , with the symmetric-information case ( $\alpha _{def}=\alpha _{ins}=0.95$ ) yielding the lowest expected losses: any deviation of $\alpha _{def}$ from $\alpha _{ins}$ in either direction leads to a suboptimal allocation and therefore higher realized losses. Intuitively, underestimating the insurer’s risk aversion leads to insufficient investment in system upgrades, while overestimating it diverts excessive funds away from insurance; in both cases, the allocation is suboptimal relative to the symmetric-information benchmark.

Figure 3

Impact of the exogenous budget allocation ratio $w$ on the insurance coverage level (left) and the expected PV of losses (right) for $a=0.5$ (top) and $a=2.5$ (bottom).

With these observations in mind, in Figure 3, we more closely examine how the insurance coverage level (left panel) and the expected PV of losses (right panel) vary with $w$ for different values of $a$ . The upper panel reveals a notable trend: when $a$ is small (i.e., the effectiveness of a system upgrade is low), a decrease in $w$ (that is, an increase in the budget proportion allocated to purchasing insurance) leads to an increase in the level of insurance coverage. This occurs because a low $a$ value implies that investing in a system upgrade yields only marginal reductions in the frequency of cyber attacks and subsequent losses, making insurance a more cost-efficient option. Additionally, the insurer is inclined to offer more extensive coverage when a higher premium is charged. However, as shown in the top-left panel, the coverage level also depends on the frequency of cyber attacks. Intuitively, proportional coverage becomes costly for the insurer when the attack frequency is high; consequently, a lower coverage level is set in such a case.

Interestingly, the top-right panel demonstrates that when $a$ is small and the frequency of cyber attacks $\lambda$ is low, opting for insurance becomes more appealing to the defender, whereas when $\lambda$ is high, investing in a system upgrade is preferred. This preference for system upgrades when $\lambda$ is high arises because a high $\lambda$ prompts the insurer to offer minimal coverage in the absence of a system upgrade. In such a case, investing in system upgrades results in a more substantial reduction in expected losses from cyber attacks compared to purchasing insurance. Consequently, the equilibrium budget allocation ratio $\widetilde {w}$ is close to $1$ . Conversely, when $\lambda$ is low, the expected number of cyber attacks and associated losses remains minimal even if the company does not invest in self-protection. Under these circumstances, the insurer is willing to provide higher coverage, making insurance a more appealing investment for the company. Thus, $\widetilde {w}$ approaches $0$ .

When $a$ is large, the impact of $w$ on the insurer’s decision and the expected PV of losses becomes more ambiguous, as exhibited in the bottom panel of Figure 3. As shown in (3), larger $a$ implies that investing in a system upgrade can lead to a more significant reduction in the frequency of future cyber attacks. Interestingly, the bottom-left panel indicates that as $w$ increases, the insurer may be willing to offer better insurance coverage (for $w\lt 0.25$ ) even if it receives a smaller premium. This counterintuitive result can be attributed to the fact that the insurer benefits from either a higher premium or a lower total claim amount, as indicated in (8). When $a$ is large, the decrease in the expected PV of future claims resulting from the defender’s investment in system upgrades surpasses the comparatively smaller premium received. The bottom-right panel also shows that the firm is more likely to benefit from a larger investment in system upgrades when $a$ is large.

Figure 4 examines the influence of cyber attack frequency on the equilibrium strategies of both the defender and the insurer. The left panel shows a decline in the equilibrium insurance coverage level as the frequency of cyber attacks increases. Notably, this coverage level approaches zero when $\lambda$ becomes exceedingly high. This is because an increase in $\lambda$ raises both the expected number of cyber attacks experienced by the firm and the claims processed by the insurer. To counterbalance this escalating claim frequency and amount, the insurer may choose to either increase the premium or decrease the coverage ratio. However, when $\lambda$ is high, the premium (see the first term in equation 8) becomes relatively small compared to the claim amount (see the second term in equation 8), making higher premiums less effective. More importantly, this reduces the budget available for system upgrades, leading to weaker frequency reduction. Consequently, the insurer benefits more from offering lower coverage, enabling the firm to allocate more funds for system upgrades. This, in turn, helps curb the frequency of cyber attacks, ultimately benefiting the insurer as well.

Figure 4

Impact of the frequency parameter $\lambda$ on the insurance coverage level (left) and the equilibrium budget allocation ratio (right).

As shown in the right panel of Figure 4, the equilibrium budget allocation ratio $\widetilde {w}$ increases with $\lambda$ in all cases, indicating that the firm invests more in system upgrades as the frequency of attacks rises. For example, when $a=0.5$ , the firm tends to allocate its entire budget to insurance when $\lambda \lt 0.45$ , or entirely to system upgrades when $\lambda \gt 1.7$ . As discussed earlier, when $\lambda$ is low, the insurer is willing to offer substantial coverage for losses, such as $\widetilde {c}=65\%$ for $a=0.5$ and $\widetilde {c}=90\%$ for $a=5$ . This makes investing in insurance a more attractive option for the firm. However, as the frequency of attacks increases, the insurer has less incentive to provide high coverage levels, even with high premiums. Consequently, the effectiveness of loss reduction through insurance diminishes, making it more advantageous for the firm to allocate a larger portion of its budget to system upgrades. When $\lambda$ becomes extremely high, the insurance company provides minimal coverage, and $\widetilde {w}$ approaches $1$ .

Finally, we investigate the impact of the frequency reduction parameter $a$ . As illustrated in Figure 5, there is a non-monotonic relationship between $a$ and the equilibrium strategies of both the firm and the insurer. Specifically, the equilibrium budget allocation ratio initially rises and then decreases with increasing $a$ , while the coverage level does the opposite. Intuitively, when $a$ is small, investing in system upgrades does not significantly reduce the frequency of future cyber attacks. Thus, the firm must allocate more resources to purchasing insurance, resulting in a lower $\widetilde {w}$ . However, as $a$ increases, the system upgrade effectiveness in reducing losses becomes more pronounced; even a small increase in $w$ can substantially decrease the frequency of future attacks, as implied by (3). Consequently, the firm may decide to allocate a larger budget to these upgrades. In response to the marked decrease in premiums, the insurer may reduce the coverage level. When $a$ reaches a high value, the projected frequency of attacks diminishes significantly, potentially approaching zero. This limits the scope for further loss reduction despite additional investments in system upgrades. Conversely, the insurer faces reduced claim amounts and is inclined to offer higher coverage. Therefore, higher coverage obtained through larger premiums (see right panel for $a\gt 1.25$ ) could outweigh the marginal reduction in attack frequency, causing $\widetilde {w}$ to decrease as $a$ increases.

Figure 5

Impact of the attack frequency reduction parameter $a$ on the equilibrium budget allocation ratio (left) and the insurance coverage level (right).