Duopoly insurers' incentives for data quality under a mandatory cyber data sharing regime

TL;DR

This paper models how mandatory cyber data sharing policies influence duopoly insurers' incentives to invest in data quality, revealing potential drawbacks of such mandates on data quality investment.

Contribution

It introduces a Cournot duopoly model analyzing insurers' incentives under mandatory data sharing, highlighting potential reductions in data quality investments.

Findings

Mandatory data sharing can lead to only one insurer investing in data quality.

Without mandates, both insurers tend to invest in data quality.

Mandatory policies may undermine overall data quality in cyber insurance.

Abstract

We study the impact of data sharing policies on cyber insurance markets. These policies have been proposed to address the scarcity of data about cyber threats, which is essential to manage cyber risks. We propose a Cournot duopoly competition model in which two insurers choose the number of policies they offer (i.e., their production level) and also the resources they invest to ensure the quality of data regarding the cost of claims (i.e., the data quality of their production cost). We find that enacting mandatory data sharing sometimes creates situations in which at most one of the two insurers invests in data quality, whereas both insurers would invest when information sharing is not mandatory. This raises concerns about the merits of making data sharing mandatory.