On the Measurement of Cyber Risk: A Comparative Analysis of Public and Industrial Data

Working Paper with Frank Cremer, Daniel Kasper & Dingchen Ning
(Current version on request)

The complexity of cyber risks continues to grow, posing significant challenges for risk management and mitigation. Cyber insurance has emerged as a key tool, providing financial protection against losses such as data breaches, business interruptions, and legal or regulatory costs associated with cyber incidents. However, one of the main obstacles in assessing cyber risk remains the scarcity of reliable data. Many cyber incidents go unreported, limiting the availability of comprehensive datasets. While databases based on publicly available information, such as Advisen, serve as valuable resources, their representativeness remains uncertain. To address this gap, we leverage a unique industry dataset that provides simulated cyber losses, offering an ideal foundation for evaluating risk distribution. First, this study provides an overview of the cyber insurance market and risk dynamics from an industry perspective. Second, it examines the alignment between realized losses and industry expectations, identifies missing quantiles in public datasets, and quantifies tail behavior. Given the granularity of the dataset, our findings offer a more precise understanding of cyber risk across industries, regions, and firms. This research provides critical insights into the insurability of cyber risks and enhances the foundation for future empirical studies.