Abstract:Internet users such as individuals and organizations are subject to different types of epidemic risks such as worms, viruses, and botnets. To reduce the probability of risk, an Internet user generally invests in self-defense mechanisms like antivirus and antispam software. However, such software does not completely eliminate risk. Recent works have considered the problem of residual risk elimination by proposing the idea of cyber-insurance. In reality, an Internet user faces risks due to security attacks as well as risks due to non-security related failures (e.g., reliability faults in the form of hardware crash, buffer overflow, etc.) . These risk types are often indistinguishable by a naive user. However, a cyber-insurance agency would most likely insure risks only due to security attacks. In this case, it becomes a challenge for an Internet user to choose the right type of cyber-insurance contract as standard optimal contracts, i.e., contracts under security attacks only, might prove to be sub-optimal for himself. In this paper, we address the problem of analyzing cyber-insurance solutions when a user faces risks due to both, security as well as non-security related failures. We propose \emph{Aegis}, a novel cyber-insurance model in which the user accepts a fraction \emph{(strictly positive)} of loss recovery on himself and transfers rest of the loss recovery on the cyber-insurance agency. We mathematically show that given an option, Internet users would prefer Aegis contracts to traditional cyber-insurance contracts, under all premium types. This result firmly establishes the non-existence of traditional cyber-insurance markets when Aegis contracts are offered to users.

Aggregate Cyber-Risk Management in the IoT Age: Cautionary Statistics for (Re)Insurers and Likes

Multivariate Risk Models under Heavy-Tailed Risks

Cyber-Insurance in Internet Security: A Dig into the Information Asymmetry Problem

The barriers to sustainable risk transfer in the cyber-insurance market

A Framework for Digital Asset Risks with Insurance Applications

Cyber risk frequency, severity and insurance viability

Pricing and Investments in Internet Security: A Cyber-Insurance Perspective

Optimal Cyber-Insurance Contract Design for Dynamic Risk Management and Mitigation

Risk Aggregation and Allocation in the Presence of Systematic Risk via Stable Laws

Resilience against Catastrophic Cyber Incidents: A Multistakeholder Analysis of Cyber Insurance

Artificial intelligence and machine learning in dynamic cyber risk analytics at the edge

Cyber risk modeling: a discrete multivariate count process approach

Capital Requirements for Cyber Risk and Cyber Risk Insurance: An Analysis of Solvency II, the U.S. Risk-Based Capital Standards, and the Swiss Solvency Test

A Novel Cyber-Insurance for Internet Security

Cyber Risk Assessment for Capital Management

Exact Insurance Premiums for Cyber Risk of Small and Medium-Sized Enterprises

An insurance theory based optimal cyber-insurance contract against moral hazard

On the Role of Risk Perceptions in Cyber Insurance Contracts

Managing Cyber Risk, a Science in the Making

A novel k-generation propagation model for cyber risk and its application to cyber insurance

The Impact of Secure OSs on Internet Security: What Cyber-Insurers Need to Know