Modeling and Pricing of Cyber Risks in the Insurance Industry

Abstract

This study examines the current state of modeling and pricing cyber risks within the insurance industry, focusing on how data availability, quality, and structure shape premium calculations. Through a systematic review of interdisciplinary literature - including open-incident repositories, actuarial surveys, qualitative practitioner studies, and quantitative loss analyses - the prevailing approaches by which insurers approximate exposure are identified, the contexts in which data are applied, and the scope of existing limitations. The findings reveal that despite the proliferation of breach registries and technical datasets, most sources lack harmonized taxonomies, comprehensive cost breakdowns, and longitudinal loss histories, compelling carriers to rely on coarse proxies such as firm size, revenue bands, and ad hoc questionnaire responses. Empirical research further demonstrates the value of richer operational indicators - IT expenditure, cloud migration rates, and controleffectiveness metrics - in enhancing model precision, yet these data remain sequestered in proprietary silos. It is also documented what practical challenges underwriters face in the absence of continuous telemetry and shared precompetitive data, which introduce subjectivity and inter-underwriter variability into pricing decisions. Finally, the critical factors influencing premiums - ranging from sectoral interdependence and heavy-tailed loss distributions to contractual design elements are delineated and regulatory reporting mandates - and propose a multi-level framework for establishing harmonized data standards, organizational consortia, and incentive structures. The study provides a comprehensive understanding of the data-centric drivers and barriers to accurately pricing cyber risk premiums, and outlines a path toward more granular, dynamic, and market-responsive insurance products.

Date of Award	2025
Original language	English
Supervisor	Stefan Fink (Supervisor)