Cyber Insurance Ratemaking: A Graph Mining Approach

Abstract

Cyber insurance ratemaking (CIRM) is a procedure used to set rates (or prices) for cyber insurance products provided by insurance companies. Rate estimation is a critical issue for cyber insurance products. This problem arises because of the unavailability of actuarial data and the uncertainty of normative standards of cyber risk. Most cyber risk analyses do not consider the connection between Information Communication and Technology (ICT) sources. Recently, a cyber risk model was developed that considered the network structure. However, the analysis of this model remains limited to an unweighted network. To address this issue, we propose using a graph mining approach (GMA) to CIRM, which can be applied to obtain fair and competitive prices based on weighted network characteristics. This study differs from previous studies in that it adds the GMA to CIRM and uses communication models to explain the frequency of communications as weights in the network. We used the heterogeneous generalized susceptible-infectious-susceptible model to accommodate different infection rates. Our approach adds up to the existing method because it considers the communication frequency and GMA in CIRM. This approach results in heterogeneous premiums. Additionally, GMA can choose more active communications to reflect high communications contribution in the premiums or rates. This contribution is not found when the infection rates are the same. Based on our experimental results, it is apparent that this method can produce more reasonable and competitive prices than other methods. The prices obtained with GMA and communication factors are lower than those obtained without GMA and communication factors.

Cyber insurance risk analysis framework considerations

“…In this respect, there are various types of algorithms in which this information can be fed. For example, researchers (Sun and Lu, 2022;Pavl ık et al, 2022) have created mixed models based on the information about breaches and the information about the insured entity, whereas Antonio et al (2021) have gone more in the direction of graph mining approach to mitigate lack of sufficient data in the market for establishing the proper pricing of the insurance policy. Further, details on security measures implemented and their maturity level are relevant, and lessons learned from previous incidents.…”

Managing Cyber Risk, a Science in the Making

“…It was our goal when co-editing a special issue on the topic (for another journal), inviting researchers from different fields to contribute with their own expertise, e.g. from forensic science (Barlatier (2020)) or with a graph mining method for approaching insurance ratemaking (Yeftanus et al (2021)), among others (see for a presentation of the papers enclosed in this special issue). Risk management is by nature pluridisciplinary.…”

Building Resilience in Cybersecurity -- An Artificial Lab Approach

“…Because of their ability to capture interconnectedness, approaches to modeling epidemics in the context of cyber risk have also appeared recently. For example, Fahrenwaldt, Weber, and Weske (2018), Xu andHua (2019), andAntonio, Indratno, andSimanjuntak (2021) study the pricing of cyber insurance policies in epidemic network models. Furthermore, the impact of cyber risk contagion on insurance portfolios has been analyzed in Hillairet and Lopez (2021), and more recently the network structure of interconnected industry sectors has been considered, see Hillairet et al (2022).…”