Working papers

The supply of cyber risk insurance 

(with Martin Eling and Anastasia Kartasheva) [draft]

Cyber risk losses are large and growing, yet the cyber insurance market remains small. What constrains the insurance industry from providing greater capacity for cyber risk? We argue that while the heavy tails and uncertain loss distributions of cyber risk require significant amounts of external contingent capital, the asymmetric information inherent in insuring cyber risk makes external capital prohibitively costly. Hence, risk financing for cyber insurers relies significantly on internal capital, which constrains overall supply. We model the risk financing of cyber insurance and then test our arguments empirically in the context of the U.S. cyber insurance market. Using an exogenous shock to the tax treatment of foreign affiliated reinsurance in 2017, we establish the causal inference that insurers primarily rely on the internal capital market to supply cyber risk insurance. Lastly, by proxying the key features of cyber risk, we show that these characteristics drive the high cost of external capital.

Conferences: 2024 NBER Insurance Group Meeting, 2024 European Economic/Econometric Annual Conference, 2024 UC Berkeley Finance seminar,  2024 Financial Intermediation Research Society's Conference, 2023 Swiss Finance Institute Research Days, 2023 German Finance Association Annual Conference, 2023 American Risk and Insurance Annual Conference,  2023 European Group of Risk Insurance Economists Annual Conference, 2023 NY Fed - Columbia Workshop on Cyber Risks to Financial Stability

Selection and screening in cyber insurance markets 

(Previously titled "Information asymmetry in cyber insurance markets" ) [draft]

This paper examines the interaction between demand-side selection and supply-side screening in the U.S. cyber insurance market, leveraging novel data from a major insurance broker. I document two stages of selection: firms with higher cyber risk are more likely both to engage a broker and to purchase insurance. Insurers primarily manage risk by capping coverage rather than differentiating prices, and use survey-based screening that is only weakly correlated with underlying risk. Market-level evidence from a tax reform using a difference-in-differences approach supports the presence of adverse selection. A theoretical framework with asymmetric information, financial frictions, and market power rationalizes these findings.

Conferences: 2025 World Risk and Insurance Economics Congress, 2024 German Finance Association Doctoral Workshop, 2024 American Risk and Insurance Annual Conference,  2024 European Group of Risk Insurance Economists Annual Conference

The changing landscape of cyber risk: An empirical analysis of loss severity and tail dynamics

(with Martin Eling and Rustam Ibragimov, accepted at Insurance: Mathematics and Economics) [pre-print] 

Cyber risk poses severe challenges to the society and has become an important theme in risk management and insurance. Yet its statistical features and evolution over time are not sufficiently understood. This paper focuses on two key dimensions of cyber risk—loss severity and tail risk—using three different cyber loss databases. We first focus on the dynamics of loss severity, identifying structural shifts in distributions through a Fréchet-based change point detection method and applying inverse probability weighting to control for selection bias. Our results indicate an increase in the severity of malicious cyber losses since 2018, whereas negligent incidents do not follow the same trend. We then propose methods that combine tail index estimation and change point detection, finding that cyber loss distributions remain heavy tailed over time, despite heterogeneity across different risk categories. Finally, we present a numerical analysis to illustrate how losses of a simulated cyber insurance portfolio evolve over time, emphasizing the importance of incorporating the dynamic properties of cyber risk into pricing strategies for insurance companies.

Conferences: 2024 European Economic/Econometric Annual Conference, 2023 Workshop on the Economics of Information Security, 2022 German Finance Association Annual Conference, 2022 American Risk and Insurance Annual Conference,  2022 European Group of Risk Insurance Economists Annual Conference