Why Cyber Risk Is So Difficult to Price

Cyber-insurance pricing is an attempt to put a number on a changing network of dependencies, not simply to average the cost of past hacks. This chapter explains why historical claims can be sparse, delayed and quickly outdated; how underwriters use dependency information and scenarios to compensate; and why the technical estimate of risk can differ from the premium and capacity the market ultimately offers. The practical judgement is to treat a cyber price as a decision under uncertainty, not as a precise measurement of the next loss.

That distinction matters because a price performs two jobs. It must be high enough, and the terms disciplined enough, for the insurer to bear the exposure without threatening its capital. It must also be low and clear enough for a firm to buy meaningful protection. An insurer that prices too low can accumulate losses it did not reserve for. An insurer that prices too high, or demands controls that many firms cannot afford, can leave the protection gap wider. Cyber insurance sits between those two failure modes while the underlying risk itself is moving.

The data problem is structural, not temporary

Traditional insurance pricing often begins with two questions: how frequently does a loss occur, and how severe is it when it does? A frequency-severity model can then estimate an aggregate loss for a pool. That approach is useful when the past contains a large, reasonably comparable body of claims and when the risks are sufficiently stable and independent.

Cyber risk weakens each assumption. The BIS Financial Stability Institute report describes incident data as scarce, fragmented and opaque. Many incidents are underreported because firms fear reputational damage, legal uncertainty or regulatory consequences. The public data that do exist may not match an insurer’s policy portfolio. A dataset may record a breach but not the same coverage, cause of loss, retention or definition of interruption that appears in a cyber contract. An event may be detected months after the initial compromise, distorting the timing of both the loss and the claim.

This creates a basic measurement problem. An insurer might observe a data breach in a public database, but still not know whether the affected firm had business-interruption cover, whether the interruption resulted from the breach, or whether a third-party provider caused the loss. A reported incident is not automatically a priced exposure. The insurer may therefore rely on proprietary claims databases, external ratings and threat intelligence. Those inputs can be valuable, but closed data make it harder for outsiders to validate the assumptions or compare one model with another.

The risk is also non-stationary. That means the process generating losses changes over time. Attackers change their tools and targets. New software, cloud services and business models create new dependencies. Artificial intelligence may change the speed and scale of phishing, vulnerability discovery or intrusion. A historical loss distribution can describe what happened under earlier technology and attacker behaviour without describing what happens after the environment changes.

This is not merely a problem of needing more observations. More data from an old environment cannot fully answer a question about a new environment. A model may become statistically better at describing yesterday’s claims while remaining poorly calibrated for a future common vulnerability or a new concentration in digital services. The source therefore treats expert judgement and scenario analysis as necessary complements to quantitative data, not as optional decoration.