Essays on risk modeling and aggregation with a focus on cyber risk

This dissertation consists of four essays exploring risk modeling and aggregation, with a particular focus on cyber risk in the insurance context. It aims to provide appropriate answers to research questions that arise from practical challenges on both the supply and demand sides of the cyber-insurance market. By answering these questions, this dissertation constructs data-driven risk modeling and aggregation methods and investigates an economic framework to represent potential insureds' behavior observed in the current market. In particular, risk modeling and aggregation methods are further applied in the study on the improvement of the regulatory model for risk capital. The first two essays, "Copula approaches for modeling cross-sectional dependence of data breach losses" and "Probable maximum cyber loss: Empirical estimation and reinsurance design with public intervention," investigate supply side challenges in the current cyber-insurance market by constructing risk modeling and aggregation methods and an alternative approach to estimating extreme losses. These essays attempt to provide a statistical process of data breach losses, their dependence structure in risk pooling, the evaluation of extreme loss events beyond a widely used Pareto model, and a possible collaboration between the public sector and the private sector in the risk transfer scheme. A challenge on the demand side of the cyber-insurance market represented by a behavioral bias is examined in the third essay, "Decision-making on cyber risk management: Interaction between market insurance and risk control measures under prospect theory", which models an economic decision on risk transfer and control measures under loss aversion assumption in the presence of interdependent risk. The finding of this essay supports anecdotal evidence of the behavioral bias against cyber risks, showing that an agent tends to not implement additional measures for cyber risk management. The fourth essay, "Risk aggregation in non-life insurance: Standard models vs. internal models", provides an approach (internal model) for more accurately estimating risk capital for insurers based on risk modeling and aggregation methods studied in the first essay. Using two datasets from Korea and Germany and assessing three regulatory schemes (Korean Risk-based Capital, Solvency II and Swiss Solvency Test), the essay concludes that the standard models lead to more than 50% higher capital requirements on average than those of internal models, which can imply a potential distortion of the competition when both approaches are available in a single market.