More Like this

1. The County Fair Cyber Loss Distribution:Drawing Inferences from Insurance Prices

   Daniel Woods, Tyler Moore (January 2019, Workshop on the Economics of Information Security)

   The actuarially fair insurance premium reflects the expected loss for each insured. Given the dearth of cyber security loss data, market premiums could shed light on the true magnitude of cyber losses despite noise from factors unrelated to losses. To that end, we extract cyber insurance pricing information from the regulatory filings of 26 insurers. We provide empirical observations on how premiums vary by coverage type, amount, policyholder type, and over time. A method using Particle Swarm Optimization is introduced to iterate through candidate parameterized distributions with the goal of reducing error in predicting observed prices. We then aggregate the inferred loss models across 6,828 observed prices from all 26 insurers to derive the County Fair Cyber Loss Distribution. We demonstrate its value in decision support by applying it to a theoretical retail firm with annual revenue of $50M. The results suggest that the expected cyber liability loss is $428K, and that the firm faces a 2.3%chance of experiencing a cyber liability loss between $100K and $10M each year. The method could help organizations better manage cyber risk, regardless of whether they purchase insurance. 

   more » « less
2. Will Catastrophic Cyber-Risk Aggregation Thrive in the IoT Age? A Cautionary Economics Tale for (Re-)Insurers and Likes

   https://doi.org/10.1145/3446635  

   Pal, Ranjan; Huang, Ziyuan; Lototsky, Sergey; Yin, Xinlong; Liu, Mingyan; Crowcroft, Jon; Sastry, Nishanth; De, Swades; Nag, Bodhibrata (June 2021, ACM Transactions on Management Information Systems)

   null (Ed.)

   Service liability interconnections among networked IT and IoT-driven service organizations create potential channels for cascading service disruptions due to modern cybercrimes such as DDoS, APT, and ransomware attacks. These attacks are known to inflict cascading catastrophic service disruptions worth billions of dollars across organizations and critical infrastructure around the globe. Cyber-insurance is a risk management mechanism that is gaining increasing industry popularity to cover client (organization) risks after a cyber-attack. However, there is a certain likelihood that the nature of a successful attack is of such magnitude that an organizational client’s insurance provider is not able to cover the multi-party aggregate losses incurred upon itself by its clients and their descendants in the supply chain, thereby needing to re-insure itself via other cyber-insurance firms. To this end, one question worth investigating in the first place is whether an ecosystem comprising a set of profit-minded cyber-insurance companies, each capable of providing re-insurance services for a service-networked IT environment, is economically feasible to cover the aggregate cyber-losses arising due to a cyber-attack. Our study focuses on an empirically interesting case of extreme heavy tailed cyber-risk distributions that might be presenting themselves to cyber-insurance firms in the modern Internet age in the form of catastrophic service disruptions, and could be a possible standard risk distribution to deal with in the near IoT age. Surprisingly, as a negative result for society in the event of such catastrophes, we prove via a game-theoretic analysis that it may not be economically incentive compatible , even under i.i.d. statistical conditions on catastrophic cyber-risk distributions, for limited liability-taking risk-averse cyber-insurance companies to offer cyber re-insurance solutions despite the existence of large enough market capacity to achieve full cyber-risk sharing. However, our analysis theoretically endorses the popular opinion that spreading i.i.d. cyber-risks that are not catastrophic is an effective practice for aggregate cyber-risk managers, a result established theoretically and empirically in the past. A failure to achieve a working re-insurance market in critically demanding situations after catastrophic cyber-risk events strongly calls for centralized government regulatory action/intervention to promote risk sharing through re-insurance activities for the benefit of service-networked societies in the IoT age. 

   more » « less
3. A copula model for marked point process with a terminal event: An application in dynamic prediction of insurance claims

   https://doi.org/10.1214/24-AOAS1902  

   Yang, Lu; Shi, Peng; Huang, Shimeng (December 2024, The Annals of Applied Statistics)

   Accurate prediction of an insurer’s outstanding liabilities is crucial for maintaining the financial health of the insurance sector. We aim to develop a statistical model for insurers to dynamically forecast unpaid losses by leveraging the granular transaction data on individual claims. The liability cash flow from a single insurance claim is determined by an event process that describes the recurrences of payments, a payment process that generates a sequence of payment amounts, and a settlement process that terminates both the event and payment processes. More importantly, the three components are dependent on one another, which enables the dynamic prediction of an insurer’s outstanding liability. We introduce a copula-based point process framework to model the recurrent events of payment transactions from an insurance claim, where the longitudinal payment amounts and the time-to-settlement outcome are formulated as the marks and the terminal event of the counting process, respectively. The dependencies among the three components are characterized using the method of pair copula constructions. We further develop a stagewise strategy for parameter estimation and illustrate its desirable properties with numerical experiments. In the application we consider a portfolio of property insurance claims for building and contents coverage obtained from a commercial property insurance provider, where we find intriguing dependence patterns among the three components. The superior dynamic prediction performance of the proposed joint model enhances the insurer’s decision-making in claims reserving and risk financing operations. 

   more » « less
4. A Semantic Approach for Automating Knowledge in Policies of Cyber Insurance Services

   https://doi.org/10.1109/ICWS.2019.00018  

   Joshi, Ketki; Pande Joshi, Karuna; Mittal, Sudip (July 2019, 2019 IEEE International Conference on Web Services (ICWS))

   With the rapid adoption of web services, the need to protect against various threats has become imperative for organizations operating in cyberspace. Organizations are increasingly opting to get financial cover in the event of losses due to a security incident. This helps them safeguard against the threat posed to third-party services that the organization uses. It is in the organization’s interest to understand the insurance requirements and procure all necessary direct and liability coverages. This helps transfer some risks to the insurance providers. However, cyber insurance policies often list details about coverages and exclusions using legalese that can be difficult to comprehend. Currently, it takes a significant manual effort to parse and extract knowledgeable rules from these lengthy and complicated policy documents. We have developed a semantically rich machine processable framework to automatically analyze cyber insurance policy and populate a knowledge graph that efficiently captures various inclusion and exclusion terms and rules embedded in the policy. In this paper, we describe this framework that has been built using technologies from AI, including Semantic Web, Modal/ Deontic Logic, and Natural Language Processing. We have validated our approach using industry standards proposed by the United States Federal Trade Commission (FTC) and applying it against publicly available policies of 7 cyber insurance vendors. Our system will enable cyber insurance seekers to automatically analyze various policy documents and make a well informed decision by identifying its inclusions and exclusions. 

   more » « less
5. Measuring Ex Ante Welfare in Insurance Markets

   https://doi.org/10.1093/restud/rdaa015  

   Hendren, Nathaniel (June 2020, The Review of Economic Studies)

   null (Ed.)

   Abstract The willingness to pay for insurance captures the value of insurance against only the risk that remains when choices are observed. This article develops tools to measure the ex ante expected utility impact of insurance subsidies and mandates when choices are observed after some insurable information is revealed. The approach retains the transparency of using reduced-form willingness to pay and cost curves, but it adds one additional sufficient statistic: the percentage difference in marginal utilities between insured and uninsured. I provide an approach to estimate this additional statistic that uses only the reduced-form willingness to pay curve, combined with a measure of risk aversion. I compare the approach to structural approaches that require fully specifying the choice environment and information sets of individuals. I apply the approach using existing willingness to pay and cost curve estimates from the low-income health insurance exchange in Massachusetts. Ex ante optimal insurance prices are roughly 30% lower than prices that maximize observed market surplus. While mandates reduce market surplus, the results suggest they would actually increase ex ante expected utility. 

   more » « less