Pricing cyber insurance
Cybersecurity risks and cyberattacks appear on 226 recent papers, mostly in AI journals, and 56 of them carry a risk-management, insurance, investment or cost keyword, with cyber insurance on 9. Insurers struggle to price a risk that is correlated across firms and shaped by the insured's own choices. What do losses look like, and does insurance change security?
What prompted this
Since October 2025, 226 papers carry a cybersecurity or cyber keyword (112 in AI journals, 49 in finance, 32 in management): "cybersecurity risks" on 39, "cybersecurity" on 35, "cyberattack detection" on 11, "cyberattacks" on 11, "cyber insurance" on 9, "cyber risk management" on 5, "cybersecurity investment" on 3. Fifty-six of the 226 carry an investment, game, insurance, optimization, cost or risk-management keyword.
Questions
- How fat-tailed and correlated are cyber losses across firms, and how much capital does an insurer need to cover a widespread event such as a cloud outage or a supply chain attack?
- Do insured firms invest more in security to get coverage, or less because they are covered, and do insurers' security requirements change behaviour?
- Did ransomware claims and the exclusions written after them change who is insurable?
Data that could help
Claims data from insurers or brokers, breach notification records, firms' security postures from external scans, and policy terms.
Next step
Fit a loss distribution to public breach and ransomware records with firm size and sector, and estimate the capital required for a portfolio with a common-cause event.