Is Systemic Cyber Risk Management for Enterprises Sustainable?

Business enterprises have grappled in the last one and half decade with unavoidable risks of (major) cyber incidents. The market to manage such risks using cyber insurance (CI) has been growing steadily but is still skeptical of the economic and societal impact of systemic risk across networked supply chains in interdependent IT-driven enterprises. While systemic risk from traditional cyber loss events might lure more capacity to the CI market, such a risk from a catastrophic (CAT) cyber loss event can quite likely reverse this trend. The sustainability of the much viable risk diversification by cyber insurers in these environments depends on (a) the statistical nature of cyber risks that contribute to systemic cyber risk and (b) the interconnection topology between enterprises. We focus here on (a) and solve the theory challenge problem of proposing simulation-validated mathematical conditions on cyber risk distributions that make systemic risk VaR diversification-friendly for CI markets.