The growing concern over cyber risk has become a pivotal issue in the business world. Firms can mitigate this risk through two primary strategies: investing in cybersecurity practices and purchasing cyber insurance. Cybersecurity investments reduce the compromise probability, while cyber insurance transfers potential losses to insurers. This study employs a network model for the spread of infection among interconnected firms and investigates how each firm’s decisions impact each other. We analyze a non-cooperative game in which each firm aims to optimize its objective function through choices of cybersecurity level and insurance coverage ratio. We find that each firm’s cybersecurity investment and insurance purchase are strategic complements. Within this game, we derive sufficient conditions for the existence and uniqueness of Nash equilibrium and demonstrate its inefficiency. These theoretical results form the foundation for our numerical studies, allowing us compute firms’ equilibrium decisions on cybersecurity investments and insurance purchases across various network structures. The numerical results shed light on the impact of network structure on equilibrium decisions and explore how varying insurance premiums influence firms’ cybersecurity investments.

This paper provides a review of cyber risk research accomplished in different disciplines, with a primary goal to aid researchers in the field of insurance and actuarial science in identifying potential research gaps as well as leveraging useful models and techniques that have been considered in the literature. We highlight the recent advancements in cyber risk prediction, modeling, management, and insurance achieved in different domains including computer engineering, actuarial science, and business studies. The surveyed works are classified according to their respective modeling approaches, allowing readers to more easily compare the technical aspects of the surveyed works and spot out research gaps based on the research tools of their liking. We conclude this paper with a summary of possible research directions that are identified from the review.

The goal of our paper is to demonstrate the potential effects of a tax on paying a ransom on the incentives of stakeholders involved: both the perpetrators (the attackers placing the ransomware) as well as the potential victim. We do think that there is a case for a ransom tax, but we do also realise that it is not easy to make that case, and hence we express this doubt in our title. A tax could stimulate ex ante cybersecurity and also (when price elasticity is not too low) reduce ex post ransom payments. In addition, a tax in combination with a smartly designed subsidy could have benefits.

We develop a novel approach for pricing cyber insurance contracts. The considered cyber threats, such as viruses and worms, diffuse in a structured data network. The spread of the cyber infection is modeled by an interacting Markov chain. Conditional on the underlying infection, the occurrence and size of claims are described by a marked point process. We introduce and analyze a new polynomial approximation of claims together with a mean-field approach that allows to compute aggregate expected losses and prices of cyber insurance. Numerical case studies demonstrate the impact of the network topology and indicate that higher order approximations are indispensable for the analysis of non-linear claims.