Statistical Modeling of Data Breach Risks: Time to Identification and Notification

TL;DR

This paper introduces a statistical modeling approach to predict the time to identification and notification in cyber incidents, addressing data gaps and capturing complex dependencies to improve risk assessment accuracy.

Contribution

It proposes a novel data imputation method and a dependence model for key cyber risk metrics, enhancing predictive performance over existing models.

Findings

The approach achieves satisfactory predictive accuracy.

It outperforms commonly used models in empirical tests.

The model effectively captures complex dependencies between metrics.

Abstract

It is very challenging to predict the cost of a cyber incident owing to the complex nature of cyber risk. However, it is inevitable for insurance companies who offer cyber insurance policies. The time to identifying an incident and the time to noticing the affected individuals are two important components in determining the cost of a cyber incident. In this work, we initialize the study on those two metrics via statistical modeling approaches. Particularly, we propose a novel approach to imputing the missing data, and further develop a dependence model to capture the complex pattern exhibited by those two metrics. The empirical study shows that the proposed approach has a satisfactory predictive performance and is superior to other commonly used models.