Abstract:We introduce a game-theoretic model to investigate the strategic interaction between a cyber insurance policyholder whose premium depends on her self-reported security level and an insurer with the power to audit the security level upon receiving an indemnity claim. Audits can reveal fraudulent (or simply careless) policyholders not following reported security procedures, in which case the insurer can refuse to indemnify the policyholder. However, the insurer has to bear an audit cost even when the policyholders have followed the prescribed security procedures. As audits can be expensive, a key problem insurers face is to devise an auditing strategy to deter policyholders from misrepresenting their security levels to gain a premium discount. This decision-making problem was motivated by conducting interviews with underwriters and reviewing regulatory filings in the U.S.; we discovered that premiums are determined by security posture, yet this is often self-reported and insurers are concerned by whether security procedures are practised as reported by the policyholders. To address this problem, we model this interaction as a Bayesian game of incomplete information and devise optimal auditing strategies for the insurers considering the possibility that the policyholder may misrepresent her security level. To the best of our knowledge, this work is the first theoretical consideration of post-incident claims management in cyber security. Our model captures the trade-off between the incentive to exaggerate security posture during the application process and the possibility of punishment for non-compliance with reported security policies. Simulations demonstrate that common sense techniques are not as efficient at providing effective cyber insurance audit decisions as the ones computed using game theory.

Using Private and Public Assessments in Security Information Sharing Agreements

Valuation of Information-Sharing in Marine Mutual Insurance

Using Bargaining Game Theory For Risk Allocation Of Public-Private Partnership Projects: Insights From Different Alternating Offer Sequences Of Participants

Security screening metrics for information‐sharing partnerships

Knowledge sharing and investment decisions in information security

Information security investment with budget constraint and security information sharing in resource-sharing environments

Privacy-Preserving Information Sharing Within an Audit Firm

A Tale of Two Mechanisms: Incentivizing Investments in Security Games

Dynamic Information Sharing and Punishment Strategies

Post-Incident Audits on Cyber Insurance Discounts

Cybersecurity Information Sharing Governance Structures: An Ecosystem of Diversity, Trust, and Tradeoffs

Poster: Using Quantified Risk And Benefit To Strengthen The Security Of Information Sharing

Special knowledge sharing incentive mechanism for two clients with complementary knowledge: A principal-agent perspective

Optimally Designing Cybersecurity Insurance Contracts to Encourage the Sharing of Medical Data

Cooperative Security Against Interdependent Risks

Information Disclosure under Competition in Sharing Systems

SMEs' Confidentiality Concerns for Security Information Sharing

Incentives for Early Arrival in Cost Sharing

Information sharing in supply chain collaboration

Information‐Sharing Strategies Based on Trust Risks Under a Governmental Incentive Mechanism