A model to analyze the challenge of using cyber insurance

Abstract

This work analyzes and extends insurance dynamics in the context of cyber risk. Cyber insurance contracts, when used as a means to manage residual cyber risk, could behave differently from other traditional (e.g., property) insurance. One important difference arises from the complexity involved in the post-breach decision of whether and how a firm should optimally plan to claim indemnity in the event of a cyber breach. We define different types of cyber breaches leading to different claiming scenarios, whose roots lie in the impact of secondary loss caused by certain but not all types of breaches. We build a model to capture the impact of secondary loss in structuring the use of cyber insurance and then combine the backward analysis of myriad breach scenarios to derive the overall optimal decision to purchase cyber insurance. We demonstrate that the optimal purchase decision depends on the mix of the types of cyber breaches that a firm faces. Numerical experiments corroborate market observation of limited use of cyber insurance after 20 years from when these products became available.

Appendices for a model to analyze the challenge of using cyber insurance

1.1 Appendix Section 1: Proof of proposition-1, Lemma-1, and Lemma-2

Proposition 1

For a secondary loss Gassociated with a realized private symptomatic breach, there exists a minimum realized loss r (=x₁ + G) up to which the insured firm does not claim its losses, for losses above r, the insured firm claims its actual loss.

Proof

The local optimization problem is reduced to locate an arbitrary point r in the loss axis (Fig. 4) such that the expected net revenue from the payout $E\left[ R(r)\right]=\underset{r}{\overset{\infty }{\int }} I(x) f(x) dx\kern0.5em -\kern0.5em \left(1- F(r)\right)$ is maximized. The FOC of the above yields the optimalr: r = I⁻¹(G). However, the point r must lie towards the right of pointx₁ (the firm has no reason to claim below the deductible and absorb just the secondary losses). Thus in general: r = I⁻¹(r − x₁). This fixes the point rconclusively, r = x₁ + G. The point r marks the boundary, beyond which the insured firm claims a suffered loss in the private breach.

Lemma 1

For any given deductible, the premium structure under adjusted pricing is never higher than that under traditional pricing i.e. P₁(x₁) ≥ P₂(x₁)

Proof

It can be shown that${P}_2={P}_1- q\;\left(1+\lambda \right)\;\gamma\;\delta \underset{x_1}{\overset{x_1+ G}{\int }}\left( x-{x}_1\right)\; f(x)\; dx$, such that for nonnegative values for G, δ, γ, and λ, P₁ ≥ P₂.

Lemma 2

For a selected deductible x₁ ,    x₁ ≥ 0 , overpricing (P₁ − P₂ ) under traditional pricing:

• 1) Increases linearly with the probability of private breach γ

• 2) Increases non-linearly with the expected secondary loss G

Proof

The overpricing is denoted as $\Delta P= q\;\left(1+\lambda \right)\;\gamma\;\delta \underset{x_1}{\overset{x_1+ G}{\int }}\left( x-{x}_1\right)\; f(x)\; dx$. Under our uniform primary loss distribution assumptions with range [a, b], these salient cases follow:

$$ \begin{array}{l} Case-1:\Delta P= q\;\left(1+\lambda \right)\;\gamma\;\delta \underset{x_1}{\overset{x_1+ G}{\int }}\left( x-{x}_1\right)\;0\; dx=0,\kern15.6em {x}_1+ G< a\\ {} Case-2:\Delta P= q\;\left(1+\lambda \right)\;\gamma\;\delta \underset{a}{\overset{x_1+ G}{\int }}\left( x-{x}_1\right)\;\frac{1}{b- a}\; dx=\frac{q\left(1+\lambda \right)\gamma \delta}{2\left( b- a\right)}\left({G}^2-{\left( a-{x}_1\right)}^2\right),\kern3.3em {x}_1< a,\kern1em a\le {x}_1+ G\le b\\ {} Case-3:\Delta P= q\;\left(1+\lambda \right)\;\gamma\;\delta \underset{a}{\overset{b}{\int }}\left( x-{x}_1\right)\;\frac{1}{b- a}\; dx=\frac{q\left(1+\lambda \right)\gamma \delta}{2}\left( b+ a-2{x}_1\right),\kern4.5em {x}_1< a,\kern1em {x}_1+ G> b\\ {} Case-4:\Delta P= q\;\left(1+\lambda \right)\;\gamma\;\delta \underset{x_1}{\overset{x_1+ G}{\int }}\left( x-{x}_1\right)\;\frac{1}{b- a}\; dx=\frac{q\left(1+\lambda \right)\gamma \delta}{2\left( b- a\right)}{G}^2,\kern8em a\le {x}_1\le b,\kern1em a\le {x}_1+ G\le b\\ {} Case-5:\Delta P= q\;\left(1+\lambda \right)\;\gamma\;\delta \underset{x_1}{\overset{b}{\int }}\left( x-{x}_1\right)\;\frac{1}{b- a}\; dx=\frac{q\left(1+\lambda \right)\gamma \delta}{2\left( b- a\right)}{\left( b-{x}_1\right)}^2,\kern7.4em a\le {x}_1\le b,\kern1em {x}_1+ G> b\end{array} $$

As a result, the overpricing of Premium exhibits the following characteristics (diagram below)

• Does not exist in the range x₁ ≤ Max{(a − G), 0}

• Increases linearly with the probability of private breach γ in the rangex₁ > Max{(a − G), 0}

• Exhibits quadratic increase with the secondary loss G in the range a < x₁ + G ≤ b

• Remains invariant of the secondary loss G in the range x₁ > Max{(b − G),  0}

  

1.2 Appendix Section 2: Derivation of utility and premium expressions

1.2.1 A. Derivation of the offered premiums in the given ranges of deductible:

Scenario-1, Unadjusted:

$$ \begin{array}{l} Case\kern0.5em 1:{P}_1= q\left(1+\lambda \right)\underset{a}{\overset{b}{\int }}\left( x-{x}_1\right)\frac{1}{b- a} dx=\frac{q\left(1+\lambda \right)}{2}\left( b+ a-2{x}_1\right)\kern13em {x}_1< a\\ {} Case\kern1em 2:{P}_1= q\left(1+\lambda \right)\underset{x_1}{\overset{b}{\int }}\left( x-{x}_1\right)\frac{1}{b- a} dx=\frac{q\left(1+\lambda \right)}{2\left( b- a\right)}{\left( b-{x}_1\right)}^2\kern14em {x}_1\ge a\\ {} Thus\kern1em in\kern0.5em general:\\ {}{P}_1=\frac{q\;\left(1+\lambda \right)}{2\left( b- a\right)}\left( b- Max\left\{ a,{x}_1\right\}\right)\left( b+ Max\left\{ a,{x}_1\right\}-2{x}_1\right)\end{array} $$

Scenario-2, Adjusted:

$$ \begin{array}{l} Case-1:{P}_2= q\left(1+\lambda \right)\left\{\underset{a}{\overset{b}{\int }}\left( x-{x}_1\right)\frac{1}{b- a} dx-\gamma \delta \underset{x_1}{\overset{x_1+ G}{\int }}\left( x-{x}_1\right).0. dx\right\}\kern14.3em \forall \kern0.5em {x}_1+ G< a\\ {}{P}_2= Max\left\{\frac{q\;\left(1+\lambda \right)}{2}\left( b+ a-2{x}_1\right),\kern0.5em 0\right\}\kern23.9em \forall \kern0.5em {x}_1+ G< a\kern1em \end{array} $$

$$ \begin{array}{l} Case-2:{P}_2= q\left(1+\lambda \right)\left\{\underset{a}{\overset{b}{\int }}\left( x-{x}_1\right)\frac{1}{b- a} dx-\gamma \delta \underset{a}{\overset{x_1+ G}{\int }}\left( x-{x}_1\right).\frac{1}{b- a}. dx\right\}\kern8em \forall \kern0.5em {x}_1< a,\kern1em a\le {x}_1+ G\le b\kern0.5em \\ {}{P}_2= Max\left\{\frac{q\;\left(1+\lambda \right)}{2\left( b- a\right)}\left\{\left( b- a\right)\left( b+ a-2{x}_1\right)-\gamma \delta \left({G}^2-{\left( a-{x}_1\right)}^2\right)\right\},\kern0.5em 0\right\}\kern8em \forall \kern0.5em {x}_1< a,\kern1em a\le {x}_1+ G\le b\end{array} $$

$$ \begin{array}{l} Case-3:{P}_2= q\left(1+\lambda \right)\left\{\underset{a}{\overset{b}{\int }}\left( x-{x}_1\right)\frac{1}{b- a} dx-\gamma \delta \underset{a}{\overset{b}{\int }}\left( x-{x}_1\right).\frac{1}{b- a}. dx\right\}\kern10em \forall \kern0.5em {x}_1< a,\kern1em {x}_1+ G> b\\ {}{P}_2= Max\left\{\frac{q\;\left(1+\lambda \right)\left(1-\gamma\;\delta \right)}{2}\left( b+ a-2{x}_1\right),\kern0.5em 0\right\}\kern16.8em \forall \kern0.5em {x}_1< a,\kern1em {x}_1+ G> b\end{array} $$

$$ \begin{array}{l} Case-4:{P}_2= q\left(1+\lambda \right)\left\{\underset{x_1}{\overset{b}{\int }}\left( x-{x}_1\right)\frac{1}{b- a} dx-\gamma \delta \underset{x_1}{\overset{x_1+ G}{\int }}\left( x-{x}_1\right).\frac{1}{b- a}. dx\right\}\kern9.7em \forall \kern0.5em {x}_1\ge a,\kern1em {x}_1+ G\le b\\ {}{P}_2= Max\left\{\frac{q\;\left(1+\lambda \right)}{2\left( b- a\right)}\left\{{\left( b-{x}_1\right)}^2-\gamma\;\delta\;{G}^2\right\},\kern0.5em 0\right\}\kern18.6em \forall \kern0.5em {x}_1\ge a,\kern1em {x}_1+ G\le b\end{array} $$

$$ \begin{array}{l} Case-5:{P}_2= q\left(1+\lambda \right)\left\{\underset{x_1}{\overset{b}{\int }}\left( x-{x}_1\right)\frac{1}{b- a} dx-\gamma \delta \underset{x_1}{\overset{b}{\int }}\left( x-{x}_1\right).\frac{1}{b- a}. dx\right\}\kern10.1em \forall \kern0.5em {x}_1\ge a,\kern1em {x}_1+ G> b\\ {}{P}_2= Max\left\{\frac{q\;\left(1+\lambda \right)\left(1-\gamma\;\delta \right)}{2\left( b- a\right)}{\left( b-{x}_{"\mathrm{s}1}\right)}^2,\kern0.5em 0\right\}\kern18.6em \forall \kern0.5em {x}_1\ge a,\kern1em {x}_1+ G> b\end{array} $$

1.2.2 B: Derivation of the expected utility of the insured firm, in the given ranges of deductible

1.3 Appendix Section 3: Adjacent problems for the experiment - solution procedure

The maximization problem of (9) can be construed as a set of adjacent sub problems defined by the pertinent ranges of the deductible. The insured firm could concurrently maximize each of these sub problems to derive the corresponding optimal deductibles, each of which is now specific to the deductible range. Finally, among all these range-specific optimal deductibles, the deductible that yields the highest expected utility among all the maximized solutions of the sub problems could then be selected for onward communication to the insurer. The dissociation of the maximization problem into a set of sub problems is sufficient without any loss in quality of solution so long the restricted range of deductible 0 ≤ x₁ ≤ b is exhaustively searched. The above process is represented in the following table, which is how we conduct our numerical experiment. Every row in Table 3 represents a sub problem, which is numerically maximized twice: once under traditional pricing (column 3), and then under adjusted pricing (column 4) of premium. The process is repeated for 10 different values of each of the parameters.

Table 3 Sub problems of expected utility maximization under traditional and adjusted premiums

1.4 Appendix Section 4: Claim oriented secondary loss based analysis

1.4.1 Claim oriented risk perception loss in stakeholders, and under-claiming strategy of the insured firm with deductible and cap provisions in cyber insurance

Denote y(x) as the claim function. Firms differ in the way they are exposed to post-claim risk perception loss g(I(y(x))). Companies dealing in sensitive personal information, engaged in major e-commerce activities, or with little brick and mortar presence may likely experience high exposure from g(I(y(x))). These firms are also highly exposed to cyber risks because of the nature of their business. Consider F_d to be one such firm and represent its secondary losses by a convex loss g(I(y(x))), such that g(0) = 0 ,  g^′(I) ≥ 0 ,  g^″(I) > 0. What this means is that as the stakeholders come to know of larger breaches through a realized indemnity, the IT security health perception about F_d is adversely revised at an increasing rate. Also, consider that the loss from cyber risk can assume any value in the positive line and the cyber contract is written with a deductible x₁ and a cap x₂.

Proposition 2

Facing a convex risk perception loss g(I(y)), for every realizationx of its random cyber loss$\tilde{X}$, an insured firm claims y = Min{x, x₂, ξ∗}, (ξ ∗  = I⁻¹(g^′−1(1))), when Min{x, x₂, ξ∗} > x₁ + g(Min{x, x₂, ξ∗} − x₁); else the firm does not claim.

Proof

Let the net revenue from indemnity be R(y) = I(y) − g(I(y)); From F.O.C., g^′(I(y)) = 1 is the condition for optimal claim because the second order derivative R^″(y) = I^″(y){1 − g^′(I(y))} − I^′(y)²g^″(I(y)) is clearly negative at g^′(I(y∗)) = 1.

Denote ξ ∗  = I⁻¹(g^′−1(1)), and consider the following cases:

Case-1:x ≤ x₁.

Because y ≤ x, andx ≤ x₁, I(y) = 0 ,  g(I(y)) = 0 ,  R(y) = 0, insured firm does not claim.

Case-2:x₁ < x.

Sub case 2A: ξ ∗  > x.

Knowing g(0) = 0, g^′(I(ξ∗)) = 1 and ξ ∗  > x, 1 − g^′(I(y)) is positive in the rangex₁ < x < ξ∗. Thus R^′(y) = I^′(y){1 − g^′(I(y))} is positive whenI^′(y) > 0, (I^′(y) > 0 in the range x₁ < y ≤ x₂) and 0 when I^′(y) = 0 (true in the range x₂ < y). Beginning at x_1, the value of I (y) increases monotonically till y = x₂, beyond which it remains constant. However, if x < x₂, the firm may claim only up to y = x. In other words, the firm claims Min{x, x₂}. R = Min{x, x₂} − x₁ − g(Min{x, x₂} − x₁), and the firm claims when R > 0. Thus the effective claim strategy is: Claim Min{x, x₂}, only when Min{x, x₂} > x₁ + g(Min{x, x₂} − x₁); else do not claim.

Sub case 2B: ξ ∗  ≤ x.

Here F_d claims Min{ξ∗, x₂} when Min{x, x₂} > x₁ + g(Min{x, x₂} − x₁).

This defines an effective under-claiming range x − ξ∗ when ξ ∗  < x. Q.E.D.