We consider an insurer who has a fixed amount of funds allocated as the initial surplus for a risk portfolio, so that the probability of ultimate ruin for this portfolio is at a known level. We consider the question of whether the insurer can reduce this ultimate ruin probability by allocating part of the initial funds to the purchase of a reinsurance contract. This reinsurance contract would restore the insurer's surplus to a positive level k every time the surplus fell between 0 and k. The insurer's objective is to choose the level k that minimizes the ultimate ruin probability. Using different examples of reinsurance premium calculation and claim size distribution we show that this objective can be achieved, often with a substantial reduction in the ultimate ruin probability from the situation when there is no reinsurance. We also show that by purchasing reinsurance the insurer can release funds for other purposes without altering its ultimate ruin probability.

No abstract

In this paper, we assume the security level of a system is a quantifiable metric and apply the insurance company ruin theory in assessing the defense failure frequencies. The current security level of an information system can be viewed as the initial insurer surplus; defense investment can be viewed as premium income resulting in an increase in the security level; cyberattack arrivals follow a Poisson process, and the impact of attacks is modeled as losses on the security level. The occurrence of cyber breach is modeled as a ruin event. We use this framework to determine optimal investment in cyber security that minimizes the total cyber costs. We show by numerical examples that there is an optimal allocation of total cyber security budget to (1) IT security maintenance/upkeep spending versus (2) external cyber risk transfer.

No abstract