Aggregate Cyber-Risk Management in the IoT Age: Cautionary Statistics for (Re)Insurers and Likes

TL;DR

This paper develops a comprehensive theoretical framework to assess the sustainability of aggregate cyber-risk coverage in IoT-enabled societies, supported by real-data analysis and strategies to enhance market viability.

Contribution

It introduces the first complete general theory on the feasibility of managing aggregate cyber-risks with heavy tails, incorporating real-data validation and market-boosting ideas.

Findings

Conditions under which cyber-risk coverage is sustainable or not.

Validation of theoretical claims using real cyber-risk data.

Strategies to improve markets for dependent heavy-tailed cyber-risks.

Abstract

In this paper, we provide (i) a rigorous general theory to elicit conditions on (tail-dependent) heavy-tailed cyber-risk distributions under which a risk management firm might find it (non)sustainable to provide aggregate cyber-risk coverage services for smart societies, and (ii)a real-data driven numerical study to validate claims made in theory assuming boundedly rational cyber-risk managers, alongside providing ideas to boost markets that aggregate dependent cyber-risks with heavy-tails.To the best of our knowledge, this is the only complete general theory till date on the feasibility of aggregate cyber-risk management.