The Price Tag of Cyber Risk: A Signal-Processing Approach

The cyber risk insurance market is rapidly developing in consideration of the potentially huge losses attributed to cyberattacks. This requires the insurance business to have a valuation and risk management framework that will enable cyber insurance policy issuers to fulfil their future obligations. We present such a framework for cyber risk modelling, wherein the cyberattacks’ occurrences as well as their inter-arrival and duration are captured by a regime-switching Markov model (RSMM). In this customised RSMM, the transition probabilities of the Markov chain are governed by another hidden Markov chain representing the various states of the cyber security environment. A self-calibrating mechanism is provided via filtering and a cyber kill chain is built based on the stages of the cyberattack. With the aid of change of reference probability measures and the EM algorithm, the estimators for the transition matrix are derived. Our main point of interest is the random losses from cyberattacks, which are assumed to follow a doubly-truncated Pareto distribution. The Vasiček model is utilised to describe the interest rate process for the discounting of losses. The premium for a cyber security insurance contract is calculated with the use of a simulated data set based on two pricing principles. Our methodology featuring dynamic parameter estimation and flexible adjustments in modelling various risk factors widens the available tools for pricing and cyber risk management.