Selection and screening in cyber insurance markets

Abstract This paper studies how information frictions shape demand, screening, and contract design in the U.S. cyber insurance market. I develop a framework in which firms sort into coverage based on latent cyber risk while insurers screen using coarse signals and manage residual exposure more through coverage quantities than through price. Using proprietary broker data, I document three findings consistent with this mechanism. First, higher‐risk firms are more likely to enter the brokered market and apply for coverage. Second, conditional on application, insurer acceptance is more closely related to a survey‐based score than to external risk measures that better capture realized incidents. Third, among issued policies, differences in assessed risk are reflected more in limits and adjusted coverage than in price. The results show that cyber insurance capacity is constrained not only by aggregate supply, but by how coarse risk classification generates residual adverse selection that insurers manage through contract design.