Investments in security and cyber-insurance are two cyber-risk management strategies that can be employed together to optimize the overall security expense. In this paper, we provide a closed form for the optimal investment under a full set of insurance liability scenarios (full liability,...

Correlation in cyber risk represents an additional source of concern for utility and industrial infrastructures, where risks may be introduced by connected systems. A major means of reducing risk is to transfer it through insurance. In this paper, we consider a company which has peripheral...

We show that classical insurance models based on some compound distributions can well predict information leakage by cyber incidents with reducing the computational cost thanks to the model’s simplicity. We use the negative binomial distribution, a renewal process and a Hawkes process as the...

In June 2017, the food and beverage conglomerate Mondelez International became a victim of the NotPetya ransomware attack. Around 1,700 of its servers and 24,000 of the company's laptops were suddenly and permanently unusable. Commercial supply and distribution disruptions, theft of credentials...

Mainstream insurance industry practices have adopted Value-at-Risk (VaR) from global financial industry as the pre-dominant cyber insurance model being oblivious to both distinguishing characteristics of cyber-risks as well as statistical properties of VaR. Such widespread misapplication of VaR...