A Model to Analyze the Unfulfilled Promise of Cyber Insurance: The Impact of Secondary Loss

[email protected] • [email protected] • [email protected] Abstract Firms often manage cyber risks first by investing in security technologies and then by purchasing cyber insurance to cover for residual risk. However, despite the increasing dependence of firms on information assets, a mature market for cyber insurance is yet to emerge. Lack of actuarial data, market inexperience and accounting difficulties are widely cited as major reasons for slow growth of cyber insurance products. Here, we consider another possible explanation: filing cyber insurance claim for a previously undisclosed breach could constitute a tacit disclosure of the breach incident. Stakeholders use such information to adversely revise their risk perception about the firm leading to a situation where an insured firm may avoid claiming losses incurred from a cyber attack. We develop a model that analyzes an insured firm’s optimal claim strategy when hit by a cyber attack. We show that this claim strategy influences the conditions for a viable market for cyber insurance products, and also explains why cyber insurance products could end up being unattractive to the target clientele. We also discuss the policy implications of our analytical findings.