Abstract:The interconnectivity of cyber and physical systems and Internet of things has created ubiquitous concerns of cyber threats for enterprise system managers. It is common that the asset owners and enterprise network operators need to work with cybersecurity professionals to manage the risk by remunerating them for their efforts that are not directly observable. In this paper, we use a principal–agent framework to capture the service relationships between the two parties, i.e., the asset owner (principal) and the cyber risk manager (agent). Specifically, we consider a dynamic systemic risk management problem with asymmetric information where the principal can only observe cyber risk outcomes of the enterprise network rather than directly the efforts that the manager expends on protecting the resources. Under this information pattern, the principal aims to minimize the systemic cyber risks by designing a dynamic contract that specifies the compensation flows and the anticipated efforts of the manager by taking into account his incentives and rational behaviors. We formulate a bi-level mechanism design problem for dynamic contract design within the framework of a class of stochastic differential games. We show that the principal has rational controllability of the systemic risk by designing an incentive compatible estimator of the agent's hidden efforts. We characterize the optimal solution by reformulating the problem as a stochastic optimal control program which can be solved using dynamic programming. We further investigate a benchmark scenario with complete information and identify conditions that yield zero information rent and lead to a new certainty equivalence principle for principal–agent problems. Finally, case studies over networked systems are carried out to illustrate the theoretical results obtained.

When q theory meets large losses risks and agency conflicts

Dynamic Agency and the q Theory of Investment

Agency and investment with triggered time-inconsistent preferences

The Interaction of the Productivity Shocks with the Agency Problem and Investment of the Company

Market timing, investment, and risk management

A Q-Theory Model with Lumpy Investment

A Heston Local-Stochastic Volatility Model for Optimal Investment-Reinsurance Strategy with a Defaultable Bond in an Ambiguous Environment

Agency Problems, Firm Valuation, and Capital Structure

Debt, Default, and Risk Management: Corporate Policies Under Incomplete Markets

Research on Buy-Back Contract for Supply Chain Coordination with Prospect Theory

A Dynamic Agency Based Asset Pricing Model with Production

Agency Dynamics in Corporate Finance

Precise large deviations of the net loss process in a non-standard two-dimensional risk model

Evolutionary game simulation of corporate investing and financing behavior from a risk perspective

Dynamic Contract Design for Systemic Cyber Risk Management of Interdependent Enterprise Networks

On stakeholder theory and corporate investment under financial frictions

Research on Optimal Investment Reinsurance of Insurance Companies under Delayed Risk Model

A Model of Dynamic Compensation and Capital Structure

Optimal design of deferred compensation for bank executives under agency conflicts

On a Perturbed Risk Model with Time-Dependent Claim Sizes

Fair Dynamic Valuation of Insurance Liabilities: A Loss Averse Convex Hedging Approach