Cyber risk has evolved from an emerging operational challenge for companies into a complex systemic exposure that can spread across organisations, supply chains, and financial markets. This special issue of The Geneva Papers on Risk and Insurance, edited by Martin Eling (University of St. Gallen) and Daniel W. Woods (University of Edinburgh), examines cyber risk, cyber insurance, and tools that could help address gaps in risk measurement, insurance coverage, and capital.
Measuring, communicating, and responding to cyber risk
In Bridging the gaps in cyber risk assessment: a comprehensive systematic review of standards, frameworks and quantification methods, Phillip Sampson et al. provide a broad assessment of approaches to measuring cyber risk. Their literature review, which considers 217 approaches across 712 studies, finds widespread use of established evaluation frameworks such as the ISO 27000 family, OCTAVE, and NIST Special Publications, alongside quantitative approaches that deploy methods such as Bayesian networks and fuzzy logic. Their analysis shows that no single way of assessing cyber risk suits every organisation. It also identifies continuing challenges around cost, access to data, and management engagement, as well as limited literature on approaches to sector-specific assessments and those tailored to small and medium-sized enterprises.
Alina Salzberger and Felix Hausruckinger examine how German-listed companies communicate their cyber risk through their annual reports in Cyber risk reporting in German listed enterprises: a textual analysis of disclosure informativeness. They find that cyber disclosures became more extensive, complex, and negative in tone between 2013–2023. Disclosure practices also vary according to company size and industry, offering insight into how businesses communicate cyber exposures as Europe moves towards more standardised reporting.
Wanggefei Wu and Stephen Shore investigate how cyber incidents change a company’s cybersecurity awareness in Spillover effects of breach incidents on cybersecurity awareness. Drawing on risk disclosures in US corporate filings, they find that firms increase their cybersecurity awareness following their own breaches and, to a lesser extent, after incidents affecting industry peers. However, increased awareness does not consistently translate into fewer future incidents, as their analysis finds that previous victims face a higher likelihood of experiencing another breach.
Closing gaps in cyber insurance coverage
In The economics of cyber risk management and insurance for small businesses, M. Martin Boyer explores how insurance contract design can influence cybersecurity investment among small businesses. His theoretical model examines how insurance protection, investment in loss-prevention technology, and the wider effects of cyber losses shape companies’ cybersecurity decisions. The findings challenge the assumption that longer-term contracts always encourage investment: under certain conditions, short-term contracts can lead businesses to invest more in risk mitigation. Because one business’s cybersecurity measures can have broad benefits, the research highlights how insurance policy design can help strengthen cyber resilience beyond individual firms.
Temima Hrle et al highlight how consumers in the US and UK understand the risks personal cyber insurance policies are intended to cover in Anticipating personal cyber insurance disputes: evidence from an online survey in the US and UK. Based on more than 3,200 participant definitions of common cyber perils, their research reveals substantial misunderstanding of what cyber insurance may cover, particularly around identity theft and data breaches. The findings suggest that clearer and more accessible policy language will be important to reducing coverage disputes and building consumer trust as the personal cyber insurance market develops.
Managing systemic risk and expanding capacity
Keywoong Bae et al analyse how cyber incidents can propagate through supply-chain networks and affect insurers’ financial strength in Systemic cyber risks and insurance regulatory capital. Their modelling shows that businesses’ operational resilience influences how quickly cyber losses are reported: more resilient firms recognise losses sooner, limiting the accumulation of incurred-but-not-reported (IBNR) claims, while reporting delays can increase pressure on insurers’ solvency. The findings suggest that regulatory capital models need to account for how cyber incidents spread between connected businesses, delays in loss reporting, and differences in operational resilience to avoid underestimating systemic cyber risk.
In Valuation of cyber catastrophe bonds and their role in portfolio efficiency: an analysis of model selection and investment implications, Niklas Anders and Mi Tang examine whether cyber catastrophe bonds can bring additional capital into the cyber risk market. Comparing five actuarial pricing approaches, they identify the Copula-POT model as the most accurate and robust. They also find that cyber catastrophe bonds can improve diversification and risk-adjusted returns within an investment portfolio. Although data limitations and model uncertainty remain challenges, the findings demonstrate the potential for alternative risk transfer to supplement traditional insurance capacity to protect against large-scale cyber events.
Access the issue at SpringerLink (subscription required for some papers).
