The Changing Landscape of Cyber Risk: An Empirical Analysis of Loss Severity and Tail Dynamics

Abstract

Cyber risk poses severe challenges to the society and has become an important theme in risk management and insurance. Yet its statistical features and how it evolves over time are not sufficiently understood. This paper focuses on two key dimensions of cyber risk—loss severity and tail risk—using three different cyber loss databases. We first focus on the dynamics of loss severity, identifying structural shifts in distributions through a Fr´echet-based change point detection method and applying inverse probability weighting to control for selection bias. Our results indicate an increase in the severity of malicious cyber losses since 2018, while negligent cyber incidents have exhibited a declining trend in severity. Then we propose a combined approach with accurate tail index estimation and change point detection and find that cyber loss distributions remain heavy tailed over time, despite heterogeneity across different risk categories. Finally, a numerical analysis is presented to illustrate how losses of a simulated cyber insurance portfolio evolve over time, emphasizing the importance of incorporating the dynamic properties of cyber risk into pricing strategies for insurance companies.

Keywords: Cyber risk, Selection bias, Change point detection, Heavy tails, Cyber insurance