Robustness of Optimal Investment Decisions in Mixed Insurance/Investment Cyber Risk Management

Abstract

An integrated risk management strategy, combining insurance and security investments, where the latter contribute to reduce the insurance premium, is investigated to assess whether it can lead to reduced overall security expenses. The optimal investment for this mixed strategy is derived under three insurance policies, covering, respectively, all the losses (total coverage), just those below the limit of maximum liability (partial coverage), and those above a threshold but below the maximum liability (partial coverage with deductibles). Under certain conditions (e.g., low potential loss, or either very low or very high vulnerability), the mixed strategy reverts however to insurance alone, because investments do not provide an additional benefit. When the mixed strategy is the best choice, the dominant component in the overall security expenses is the insurance premium in most cases. Optimal investment decisions require an accurate estimate of the vulnerability, whereas larger estimation errors may be tolerated for the investment‐effectiveness coefficient.

Optimal Investment in Cyber-Security under Cyber Insurance for a Multi-Branch Firm

“…• We provide a closed formula for the optimal investment in security under vulnerability correlation, extending the results presented in Mazzoccoli and Naldi (2019), where cyber-risk interdependence is not taken into account.…”

“…We observe then a region of intermediate vulnerability values for which the solution obtained from Equation (13) is a valid (positive) investment. It pays to invest in security as long as the intrinsic vulnerability (i.e., in the absence of investments) is neither too high (above v i2 ) nor too low (below v i1 ), as shown by Mazzoccoli and Naldi (2019). We can now turn to the headquarters.…”

“…In Young et al (2016), security investments are considered as a means to achieve lower premiums (since cyber-risk is reduced) and therefore lower the barriers for the adoption of cyber-insurance: the overall security expense is represented by the sum of the investments and the insurance premium and can be minimized through a proper choice of the amount of investment. In Mazzoccoli and Naldi (2019), the optimization task is explicitly dealt with by providing closed-form formulas for the optimal investment under three liability scenarios for the insurer.…”

“…To find the optimal investmentẑ (full) i for the ith branch, we can exploit the result reported in Mazzoccoli and Naldi (2019):…”

“…In this paper, we then extend the analysis carried out in Mazzoccoli and Naldi (2019) by considering the case of a company having multiple branches, whose security breaches may endanger the headquarters' security as well, and the headquarters wish to minimize their overall security expense.…”