Cybersecurity investment considering risk prevention and mitigation measures: A security insurance perspective

Information security insurance is becoming one of the most important tools for managing information security risks as a result of the sophistication of strategic hackers. This paper examines the effect of security insurance on information security investment through constructing a game-theoretic model involving hackers and a firm, where the firm's security investments are divided into prevention and mitigation measures. The results show the firm's prevention and mitigation security efforts increase while the hackers' attack efforts decrease with the intrusion loss. For both parties, their optimal efforts do not necessarily increase with their respective efficiency. The coverage and depth of insurance diminishes a firm's effort in risk prevention, and consequently increases hackers' attack effort. Moreover, we distinguish two types of security externalities including insurer-side externality and hacker-side externality. In addition, we show that when purchasing security insurance, the firm always enhances the risk mitigation measures, further strengthening risk prevention measures under some conditions. We also find that a high premium reduces a firm's expected profit, prompting it to avoid purchasing insurance, which in turn encourages hackers to intensify their attacks. Finally, the basic model is extended to generalize the main results.