Economics of incident response panels in cyber insurance

• DOI: 10.1016/j.cose.2024.103742
• Publication Date: 2024-02-01T23:51:03Z
• Authors: Daniel Arce; Daniel W. Woods; Rainer Böhme
• Keywords: Data breach; Hotline; Adverse selection; Property insurance; Business interruption insurance

Cyber insurance is becoming a popular cyber risk management tool. Beyond pure financial transfer, prior theoretical works anticipated that would influence the mitigation measures employed by policyholders, such as excluding losses caused security mismanagement or offering premium discounts for controls. Empirical literature has shown ineffective at influencing pre-breach levels; however, it also identified how insurers indemnify cost of team post-breach providers with expertise spanning legal, technical, and communications. Our work models peculiarities institution, panel, triages incidents assigns firms. In particular, we model incomplete aspect this contract in which policyholders may be assigned less efficient firm, can interpreted bait switch. At same time, our context switch business-to-business (B2B) differs from usual understanding phenomenon an upsell. Consequently, new managerial implications arise on insurer-side market. We characterise conditions under accept their insurer's hotline recommendation incident response contract. additionally show panels mitigate adverse selection problem respect to policyholders' including differentiated efficiency.