1. Insurability of Cyber Risk: An Empirical Analysis
Christian Biener, Martin Eling, and Jan Hendrik Wirfs
University of St. Gallen, Switzerland
Institute of Insurance Economics
IIS 50th Annual Seminar in London
June 24, 2014

2. Cyber Risk – Big Threat to Global Economy
Ø Natural Cat Losses
< $200 Billion
Data source: Munich Re, 2014
Estimated Cost from Global Cyber Activity
Data source: McAfee, 2013
Upper Bound
$1 Trillion
Lower Bound
$300 Billion

3. Cyber Risk – Big Market Opportunities
Average Information Security Budget (PWC, 2014)
2009
2013
$ 2.7 million
$ 4.3 million
+15% p.a.
Cyber Insurance
Mature Markets
> 10% 1%
Insurance Gross Premium Growth p.a. (Swiss Re, 2014 | Betterley, 2013)

4. Contribution – Cyber Risk Insurability
25 relevant and high-quality studies published between 2002 and 2014
Literature Review
SAS OpRisk Global Data:
22,075 operational loss incidents between and 2009
Cyber Risk Data
Classification of risks in terms of actuarial, market, and societal conditions (see Berliner, 1982)
Is Cyber Risk Insurable?

5. 90% of Incidents Related to People
Allocation of Cyber Risk Incidents to Cyber Risk Categories
Unintentional and intentional actions as well as failure to act
Actions of People
90%
Undetermined
31%
15%
42%
Vulnerable Code
Misconfigured System
End-user Error
Targeted Attack 6%
Data source: IBM, 2013
Failures of hardware, software, and integrated systems
Systems Failure 4%
Failures of processes due to
poor process design /controls
Failed Internal Processes 4%
Catastrophes, legal issues, service dependence
External Events 1%
Data source: SAS OpRisk Global Data

6. The Insurability Framework
Insurability Criteria Requirements Assessment
Actuarial
(1)
Randomness of Losses
Independence and Predictability 
(2)
Maximum Possible Loss
Manageable 
(3)
Average Loss per Event
Moderate
(4)
Loss Exposure
Large Loss Exposure
(5)
Information Asymmetry
No Moral Hazard and Adverse Selection
(6)
Insurance Premium
Cost Recovery / Affordability
(7)
Cover Limits
Acceptable
(8)
Public Policy
Consistent With Societal Values
(9)
Legal Restrictions
Allow for Coverage ?
Market ?
Societal ?

7. Implications for the Insurance Industry
Insurers
Important Role of Insurers  Put a Price Tag on Cyber Risk
Need for Increasing Product Value  Lower Deductibles, Higher Caps
Need for More Re-Insurance Capacity  Diversification
Need for a Reduction of Ambiguity Towards Cyber Risk Coverage
Industry Data-Sharing to Enhance Systematic Learning
Industry Surveys Help Capture Dynamic Changes
Regulators
Outlook
Increasing Cyber Risk Insurance Demand Expected
Followed by Increasing Availability and Competition
Significant Potential for Future Research

8. Cyber Risk – We’re Talking About Dave
Copyright 2006 John Klossner |

9. Insurability of Cyber Risk: An Empirical Analysis
Christian Biener, Martin Eling, and Jan Hendrik Wirfs
University of St. Gallen, Switzerland
Institute of Insurance Economics
IIS 50th Annual Seminar in London
June 24, 2014

10. References
Berliner, B., 1982, Limits of Insurability of Risks, Englewood Cliffs, NJ: Prentice-Hall.
Betterley, R.S., 2013, Cyber/Privacy Insurance Market Survey 2013: Carriers deepen their risk management services benefits—Insureds grow increasingly concerned with coverage limitations.
Cebula, J.J. and Young, L.R., 2010, A Taxonomy of Operational Cyber Security Risks, Technical Note CMU/SEI-2010-TN-028, Software Engineering Institute, Carnegie Mellon University.
IBM, 2013, The 2013 IMB Cyber Security Intelligence Index, ibm.com/services/us/en/security/infographic/cybersecurityindex.html.
McAfee, 2013, The Economic Impact of Cybercrime and Cyber Espionage.
Munich Re, 2014, 2013 Natural Catastrophe Year in Review.
Ponemon Institute, 2014, 2014 Cost of Data Breach Study: Global Analysis
PWC, 2014, The Global State of Information Security® Survey 2014.
SAS OpRisk Global Data, 2010, sas-oprisk-globaldata-brief.pdf.
Swiss Re, 2014, Swiss Re Economic Research and Consulting.