Interdependent cyber risk and the role of insurers

Abstract

Increasing use of new digital services offers tremendous opportunities for modern society, but also entails new risks. One tool for managing cyber risk is cyber insurance. While cyber insurance has attracted much attention and optimism, interdependent cyber risks and lack of actuarial data have prompted some insurers to adopt a more proactive role, not only insuring losses but also assisting clients with preventive work such as managed detection and response solutions, i.e., investments in their own cybersecurity. The purpose of this paper is to propose and theoretically investigate yet a further extension of this role, where insurers facilitate security investments between interdependent firms, which get the opportunity to invest a share of their insurance premiums to improve the security of each other. It is demonstrated that if insurers can facilitate such investments, then under common theoretical assumptions this can make a positive contribution to overall welfare. The paper is concluded by a discussion of the relevance and applicability of this theoretical contribution in practice.