This study examines how organizations conceptualize and manage cyber risk, finding a gap between the normative risk-based management approach and actual practices. Organizations often use qualitative assessments masked as quantitative, creating an illusion of precision. The study proposes "qualculation" as the highest standard for aligning cyber risk measurement and management.
This paper develops a k-generation risk contagion model in a tree-shaped network for cyber insurance pricing. It accounts for contagion location and security level heterogeneity. Using Bayesian network principles, it derives mean and variance of aggregate losses, aiding accurate cyber insurance pricing. Key findings benefit risk managers and insurers.
Cyber risk presents significant challenges to society, yet its statistical behavior remains insufficiently understood. This paper analyzes three databases to study cyber risk dynamics. It identifies increasing frequency and severity, particularly in malicious events since 2018. Persistent heavy-tailedness across risk categories implies lower insurance demand and potentially heightened risk levels for firms.
The challenge for cyber insurers lies in the scarcity of data, hindering risk assessment and product development. Organizations fear sharing information due to the risk of further attacks. Balancing transparency with discretion is crucial. With better data sharing, insurers can offer tailored products, assess risks accurately, and enhance corporate compliance.
"Using a novel firm-level measure of cybersecurity, we find that cybersecurity risk increases the probability of bank default. The effect is larger for banks with deposit withdrawal, but less pronounced for banks with liquidity buffer. Our results are robust to using an instrumental variable approach and to using alternative measures. "