In the big data and “Internet+” era, the research related cybersecurity risk has attracted much attention. However, Premium pricing for cybersecurity insurance remains in its early days. In this paper, we established a premium pricing method for cybersecurity risks. Firstly, the losses during the cyber infection is modeled by an interacting Markov SIS (Susceptible-Infected-Susceptible) epidemic model. we also proposed a premium simulation method called the Gillespie algorithm, which can be used for simulation of a continuous-time stochastic process. At last, as an example, we calculated the premiums by using premium principles and simulation in a simple network respectively. The numerical case studies demonstrate the premium pricing model performs well, and the premiums based on simulations are rather conservative, and recommended using in practice by comparing the results of premiums.
QinY.Q., PengY., HuangK.X., ZhouC.J. and TianY.C., Association Analysis-Based Cybersecurity Risk Assessment for Industrial Control Systems, IEEE Syst J15 (2021), 1423–1432.
2.
RodriguesA.F., MonteiroB.M. and PedrosaI., Cybersecurity risks A behavioural approach through the influence of media and information literacy, in: 16th Iberian Conference on Information Systems and Technologies (CISTI), Ieee, Electr Network, 2021.
3.
AborujilahA., Al-OthmaniA.Z., HussienN.S., MokhtarS.A., LongZ.A. and NizamM., Ieee, Cybersecurity Risk Assessment Approach for Malaysian Organizations: Malaysian Universities as Case Study, in: 9th International Conference on Electrical and Electronics Engineering (ICEEE), Ieee, Alanya, TURKEY, 2022, pp. 440–450.
4.
BaybulatovA.A. and PromyslovV.G., On Cybersecurity Risk Assessment in Nuclear Power Systems, in: 11th IFAC Symposium on Control of Power and Energy Systems (CPES), Elsevier, Electr Network, 2022, pp. 233–237.
5.
RosadoD.G., Santos-OlmoA., SanchezL.E., SerranoM.A., BlancoC., MouratidisH. and Fernandez-MedinaE., Managing cybersecurity risks of cyber-physical systems: The MARISMA-CPS pattern, Comput Ind142 (2022), 20.
6.
VargasP. and TienI., Methodology to Quantitatively Assess Impacts of 5G Telecommunications Cybersecurity Risk Scenarios on Dependent Connected Urban Transportation Systems, ASCE-ASME J Risk Uncertain Eng Syst Part A-Civ Eng8 (2022), 15.
7.
ZhaoX.P., AbdoA., LiaoX.S., BarthM. and WuG.Y., Evaluating Cybersecurity Risks of Cooperative Ramp Merging in Mixed Traffic Environments, IEEE Intell Transp Syst Mag14 (2022), 52–65.
8.
ShaikhF.A. and SiponenM., Information security risk assessments following cybersecurity breaches: The mediating role of top management attention to cybersecurity*, Comput Secur124 (2023), 8.
9.
YanoE.T., BhattP., GustavssonP.M. and AhlfeldtR.M., Ieee, Towards a Methodology for Cybersecurity Risk Management Using Agents Paradigm, in: IEEE Joint Intelligence and Security Informatics Conference (JISIC 2014), Ieee, Hague, NETHERLANDS, 2014, pp. 323–323.
10.
AxelrodC.W., Ieee, Cybersecurity risks of RFID for mines and unexploded ordnance, in: IEEE International Symposium on Technologies for Homeland Security (HST), Ieee, Waltham, MA, 2015.
11.
LarkinH.D., Cybersecurity Risk for Medtronic Insulin Pump, JAMA-J Am Med Assoc328 (2022), 1679–1679.
12.
LunaA., LevyY., SimcoG. and LiW., Ieee, Proposed Empirical Assessment of Remote Workers’ Cyberslacking and Computer Security Posture to Assess Organizational Cybersecurity Risks, in: IEEE High Performance Extreme Computing Virtual Conference (HPEC), Ieee, Electr Network, 2022.
13.
PoyhonenJ., LehtoM. and Acad ConfL.T.D., Assessment of Cybersecurity Risks: Maritime Automated Piloting Process, in: 17th International Conference on Cyber Warfare and Security (ICCWS), Acad Conferences Ltd, State Univ New York, Albany, NY, 2022, pp. 262–271.
14.
RaduC. and SmailiN., Board Gender Diversity and Corporate Response to Cyber Risk: Evidence from Cybersecurity Related Disclosure (Jan, 10.1007/s10551-020-04717-9, 2021), Journal of Business Ethics177 (2022), 375–375.
15.
KatsumataP., HemenwayJ. and GavinsW., Ieee, Cybersecurity Risk Management, in: MILCOM Military Communications Conference, Ieee, San Jose, CA, 2010, pp. 890–895.
16.
CirnuC.E., RotunaC.I., VeveraA.V. and BonceaR., Measures to Mitigate Cybersecurity Risks and Vulnerabilities in Service-Oriented Architecture, Stud Inform Control27 (2018), 359–368.
SaxonL.A., VarmaN., EpsteinL.M., GanzL.I. and EpsteinA.E., Factors Influencing the Decision to Proceed to Firmware Upgrades to Implanted Pacemakers for Cybersecurity Risk Mitigation, Circulation138 (2018), 1274–1276.
19.
Clark-GinsbergA. and SlaytonR., Regulating risks within complex sociotechnical systems: Evidence from critical infrastructure cybersecurity standards, Sci Public Policy46 (2019), 339–346.
20.
DobajJ., EkertD., StolfaJ., StolfaS., MacherG. and MessnarzR., Cybersecurity Threat Analysis, Risk Assessment and Design Patterns for Automotive Networked Embedded Systems: A Case Study, J Univers Comput Sci27 (2021), 830–849.
21.
KalininM., KrundyshevV. and ZegzhdaP., Cybersecurity Risk Assessment in Smart City Infrastructures, Machines9 (2021), 19.
RadanlievP., De RoureD., PageK., Van KleekM., SantosO., MaddoxL.T., BurnapP., AnthiE. and MapleC., Design of a dynamic and self-adapting system, supported with artificial intelligence, machine learning and real-time intelligence for predictive cyber risk analytics in extreme environments–cyber risk in the colonisation of Mars, Safety in Extreme Environments2 (2020), 219–230.
24.
RadanlievP., De RoureR., Van KleekM., MontalvoR.M., MaddoxL.T., SantosO., BurnapP. and AnthiE., Artificial intelligence and machine learning in dynamic cyber risk analytics at the edge, SN Applied Sciences2 (2020), 1–8.
25.
RadanlievP. and De RoureD., Advancing the cybersecurity of the healthcare system with self-optimising and self-adaptative artificial intelligence, Health and Technology12 (2022), 923–929.
VesselsL., HeffnerK., JohnsonD. and Ieee CompS.O.C., Cybersecurity Risk Assessment for Space Systems, in: IEEE Space Computing Conference (SCC), Ieee Computer Soc, Pasadena, CA, 2019, pp. 11–19.
28.
ArgawS.T., Troncoso-PastorizaJ.R., LaceyD., FlorinM.V., CalcavecchiaF., AndersonD., BurlesonW., VogelJ.M., O’LearyC., Eshaya-ChauvinB. and FlahaultA., Cybersecurity of Hospitals: discussing the challenges and working towards mitigating the risks, BMC Med Inform Decis Mak20 (2020), 10.
29.
JardineE., The Case against Commercial Antivirus Software: Risk Homeostasis and Information Problems in Cybersecurity, Risk Anal40 (2020), 1571–1588.
30.
MollaeefarM., SienaA. and RaniseS., Multi-Stakeholder Cybersecurity Risk Assessment for Data Protection, in: 17th International Joint Conference on E-Business and Telecommunications (SECRYPT), Scitepress, Electr Network, 2020, pp. 349–356.
31.
PresleyS.S., LandryJ.P., ShropshireJ. and Assoc InformatS., Multi-Stakeholder Cybersecurity Risk Assessment for Data Protection, in: 17th International Joint Conference on E-Business and Telecommunications (SECRYPT), Scitepress, Electr Network, 2020, pp. 349–356.
32.
LemnitzerJ.M., Why cybersecurity insurance should be regulated and compulsory, Journal of Cyber Policy6 (2021), 118–136.
33.
BodinL.D., GordonL.A., LoebM.P. and WangA., Cybersecurity insurance and risk-sharing, J Account Public Policy37 (2018), 527–544.
34.
KesanJ.P. and HayesC.M., Strengthening Cybersecurity with Cyberinsurance Markets and Better Risk Assessment, Minn Law Rev102 (2018), 191–276.
35.
KingZ.M., HenshelD.S., FloraL., CainsM.G., HoffmanB. and SampleC., Characterizing and Measuring Maliciousness for Cybersecurity Risk Assessment, Front Psychol9 (2018), 19.
36.
LiH., NoW.G. and WangT.W., SEC’s cybersecurity disclosure guidance and disclosed cybersecurity risk factors, Int J Account Inf Syst30 (2018), 40–55.
37.
PaulsenJ.E., HazelettM.B. and SchwartzS.B., CIED Cybersecurity Risks in an Increasingly Connected World, Circulation138 (2018), 1181–1183.
38.
ElingM., Cyber risk research in business and actuarial science, European Actuarial Journal10 (2020), 303–333.
39.
FarkasS., LopezO. and ThomasM., Cyber claim analysis using Generalized Pareto regression trees with applications to insurance, Insurance Mathematics & Economics98 (2021), 92–105.
40.
HerathH.S. and HerathT.C., Copula-based actuarial model for pricing cyber-insurance policies, Insurance Markets and Companies2 (2011).
41.
ElingM. and SchnellW., What do we know about cyber risk and cyber risk insurance?The Journal of Risk Finance17 (2016), 474–491.
42.
ElnagdyS.A., QiuM.K. and GaiK.K., Ieee, Understanding Taxonomy of Cyber Risks for Cybersecurity Insurance of Financial Industry in Cloud Computing, in: 3rd IEEE International Conference on Cyber Security and Cloud Computing (IEEE CSCloud) / 2nd IEEE International Conference of Scalable and Smart Cloud (IEEE SSC), Ieee, Beijing, PEOPLES R CHINA, 2016, pp. 295–300.
43.
FaraoA., PandaS., MenesidouS.A., VeliouE., EpiskoposN., KalatzantonakisG., MohammadiF., GeorgopoulosN., SirivianosM., SalamanosN., LoizouS., PingosM., PolleyJ., FielderA., PanaousisE. and XenakisC., SECONDO: A Platform for Cybersecurity Investments and Cyber Insurance Decisions, in: 17th International Conference on Trust, Privacy and Security in Digital Business (TrustBus), Springer International Publishing Ag, Electr Network, 2020, pp. 65–74.
44.
ElnagdyS.A., QiuM.K. and GaiK.K., Ieee, Cyber Incident Classifications Using Ontology-Based Knowledge Representation for Cybersecurity Insurance in Financial Industry, in: 3rd IEEE International Conference on Cyber Security and Cloud Computing (IEEE CSCloud) / 2nd IEEE International Conference of Scalable and Smart Cloud (IEEE SSC), Ieee, Beijing, PEOPLES R CHINA, 2016, pp. 301–306.
45.
GaiK.K., QiuM.K. and HassanH., Secure cyber incident analytics framework using Monte Carlo simulations for financial cybersecurity insurance in cloud computing, Concurr Comput-Pract Exp29 (2017), 13.
46.
LauP., WeiW., WangL.F., LiuZ.X. and TenC.W., A Cybersecurity Insurance Model for Power System Reliability Considering Optimal Defense Resource Allocation, IEEE Trans Smart Grid11 (2020), 4403–4414.
47.
WoodsD.W. and MooreT., Does Insurance Have a Future in Governing Cybersecurity?IEEE Secur Priv18 (2020), 21–27.
48.
FahrenwaldtM.A., WeberS. and WeskeK., Pricing of cyber insurance contracts in a network model, Astin Bulletin48 (2018), 1175–1218.
49.
XuM. and LeiH., Cybersecurity insurance: modeling and pricing, North American Actuarial Journal23 (2019), 220–249.
50.
XuM., DaG. and XuS., Cyber epidemic models with dependences, Internet Mathematics11 (2015), 62–92.
51.
Van MieghemP. and CatorE., Epidemics in networks with nodal self-infection and the epidemic threshold, Physical Review E86 (2012).
52.
ZellerG. and SchererM., A comprehensive model for cyber risk based on marked point processes and its application to insurance, European Actuarial Journal12 (2022), 33–85.
53.
KephartJ.O. and WhiteS.R., Directed-graph epidemiological models of computer viruses, in: Computation: the micro and the macro view, World Scientific, 1992, pp. 71–102.
54.
KermackW.O. and MckendrickA.G., Contributions to the mathematical-theory of epidemics.1. (reprinted from proceedings of the royal society, vol. 115a, pg 700–721, 1927), Bull Math Biol53 (1991), 33–55.
55.
KermackW.O. and McKendrickA.G., Contributions to the mathematical-theory of epidemics.2. The problem of endemicity (reprinted from proceedings of the royal society, vol 138a, pg 55–83, 1932), Bull Math Biol53 (1991), 57–87.
56.
KermackW.O. and McKendrickA.G., Contributions to the mathematical-theory of epidemics.3. Further-studies of the problem of endemicity (reprinted from proceedings of the royal society, vol 141a, pg 94–122, 1933), Bull Math Biol53 (1991), 89–118.
57.
DoobJ.L., Markoff chains-denumerable case, Transactions of the American Mathematical Society58 (1945), 455–473.
58.
VestergaardC.L. and GenoisM., Temporal Gillespie Algorithm: Fast Simulation of Contagion Processes on Time-Varying Networks, PLoS Comput Biol11 (2015), 28.
59.
DoobJ.L., Topics in the theory of Markoff chains, Transactions of the American Mathematical Society52 (1942), 37–64.
60.
BrownM. and SolomonH., A second-order approximation for the variance of a renewal reward process, Stochastic Processes and Their Applications3 (1975), 301–314.
