The Nature of Losses from Cyber-Related Events: Risk Categories and Business Sectors

TL;DR

This paper analyzes cyber-related losses across sectors and risk categories, revealing increasing frequency, sector-specific patterns, heavy-tailed risk distributions, and significant temporal variability in losses.

Contribution

It provides a comprehensive empirical analysis of cyber loss data, highlighting the heavy-tailed nature and dynamic patterns of cyber risks across sectors and threat types.

Findings

Cyber event frequency increased from 2008 to 2016

Data breaches are the most common loss category

Cyber risks exhibit heavy-tailed severity distribution

Abstract

In this study we examine the nature of losses from cyber related events across different risk categories and business sectors. Using a leading industry dataset of cyber events, we evaluate the relationship between the frequency and severity of individual cyber-related events and the number of affected records. We find that the frequency of reported cyber related events has substantially increased between 2008 and 2016. Furthermore, the frequency and severity of losses depend on the business sector and type of cyber threat: the most significant cyber loss event categories, by number of events, were related to data breaches and the unauthorized disclosure of data, while cyber extortion, phishing, spoofing and other social engineering practices showed substantial growth rates. Interestingly, we do not find a distinct pattern between the frequency of events, the loss severity, and the number of affected records as often alluded to in the literature. We also analyse the severity distribution of cyber related events across all risk categories and business sectors. This analysis reveals that cyber risks are heavy-tailed, i.e., cyber risk events have a higher probability to produce extreme losses than events whose severity follows an exponential distribution. Furthermore, we find that the frequency and severity of cyber related losses exhibits a very dynamic and time varying nature.