Cyber (Re-)Insurance Policy Writing Is Np-Hard In Iot Societies

Abstract

The last decade has witnessed steadily growing markets for cyber (re-)insurance products to mitigate residual cyber-risk. In this introductory effort, we prove that underwriting simple cyber re-insurance policies can be worst case computationally hard, i.e., NP-Hard, especially for upcoming IoT societies. More specifically, let alone human underwriters, even a computer cannot compute an optimal cyber re-insurance policy in a reasonable amount of time in worst case scenarios. Here, optimality of a contract is judged based on the extent of information asymmetry induced negative externalities it mitigates between a re-insurance seller and a buyer. Our result does not challenge the existence of cyber re-insurance markets that we feel will be a necessity in the IoT age, but only rationalizes why their growth might be slow, and would subsequently need regulatory intervention. As a direct applicability of our methodology, we argue that optimal traditional cyber-insurance underwriting in IoT societies is also NP-Hard.