Working papers

Selection and screening in cyber insurance markets 

(Previously titled "Information asymmetry in cyber insurance markets" ) [draft upon request]

This paper examines the interaction between demand-side selection and supply-side screening in the U.S. cyber insurance market, leveraging novel data from a major insurance broker. I document two stages of selection: firms with higher cyber risk are more likely both to engage a broker and to purchase insurance. Insurers primarily manage risk by capping coverage rather than differentiating prices, and use survey-based screening that is only weakly correlated with underlying risk. Market-level evidence from a tax reform using a difference-in-differences approach supports the presence of adverse selection. A theoretical framework with asymmetric information, financial frictions, and market power rationalizes these findings.

Conferences: 2024 German Finance Association Doctoral Workshop, 2024 American Risk and Insurance Annual Conference,  2024 European Group of Risk Insurance Economists Annual Conference

The supply of cyber risk insurance 

(with Martin Eling and Anastasia Kartasheva) [draft]

Cyber risk losses are large and growing, yet the cyber insurance market remains small. What constrains the insurance industry from providing greater capacity for cyber risk? We argue that while the heavy tails and uncertain loss distributions of cyber risk require significant amounts of external contingent capital, the asymmetric information inherent in insuring cyber risk makes external capital prohibitively costly. Hence, risk financing for cyber insurers relies significantly on internal capital, which constrains overall supply. We model the risk financing of cyber insurance and then test our arguments empirically in the context of the U.S. cyber insurance market. Using an exogenous shock to the tax treatment of foreign affiliated reinsurance in 2017, we establish the causal inference that insurers primarily rely on the internal capital market to supply cyber risk insurance. Lastly, by proxying the key features of cyber risk, we show that these characteristics drive the high cost of external capital.

Conferences: 2024 NBER Insurance Group Meeting, 2024 European Economic/Econometric Annual Conference, 2024 UC Berkeley Finance seminar,  2024 Financial Intermediation Research Society's Conference, 2023 Swiss Finance Institute Research Days, 2023 German Finance Association Annual Conference, 2023 American Risk and Insurance Annual Conference,  2023 European Group of Risk Insurance Economists Annual Conference, 2023 NY Fed - Columbia Workshop on Cyber Risks to Financial Stability

The changing landscape of cyber risk: An empirical analysis of frequency, severity, and tail dynamics

(with Martin Eling and Rustam Ibragimov, previously titled "Time dynamics of cyber risk") [draft] 

Cyber risk poses severe challenges to modern society and has become an important theme in risk management and insurance. Yet its statistical features and how it evolves are not sufficiently understood in the literature. This paper utilizes three databases to examine the dynamic properties of cyber risk. We first deal with report delays with an extended two-stage generalized Dirichlet multinomial framework and then identify structural changes in the frequency and severity of different risk categories using multiple change point detection methods. We document that for malicious events the frequency has grown exponentially in the past two decades and the financial loss distribution has shifted toward greater severity since 2018. The increasing trends for other categories are slower in frequency and less clear in severity. We also explore the tail dynamics by combining tail estimation and optimal threshold selection methods and find that the heavy-tailedness of cyber risk is persistent across all categories. Finally, we discuss the implications of documented empirical features and show theoretically that they lead to lower insurance demand and potentially higher risk levels for firms. 

Conferences: 2024 European Economic/Econometric Annual Conference, 2023 Workshop on the Economics of Information Security, 2022 German Finance Association Annual Conference, 2022 American Risk and Insurance Annual Conference,  2022 European Group of Risk Insurance Economists Annual Conference