Modeling and pricing cybersecurity insurance with information asymmetry

Rong Hu; Na Ren; Xin Zhang; Rong Hu; Na Ren; Xin Zhang

doi:10.3934/math.2026904

AIMS Mathematics

2026, Volume 11, Issue 7: 22354-22379. doi: 10.3934/math.2026904

Previous Article Next Article

Research article Special Issues

Modeling and pricing cybersecurity insurance with information asymmetry

Rong Hu ¹,
Na Ren ²,
Xin Zhang ^{1
,
,}

1.
School of Mathematics, Southeast University, Nanjing 211189, China
2.
School of Science, Lanzhou University of Technology, Lanzhou 730050, China

Received: 26 May 2026 Revised: 05 July 2026 Accepted: 14 July 2026 Published: 27 July 2026
MSC : 91B41, 91B43

Firms typically invest in security measures to reduce potential losses from cyber incidents. Since such measures cannot fully eliminate cyber risks, cyber insurance plays an important role in hedging residual losses. This paper studies contract design in a monopolistic cyber insurance market where policyholders differ in their underlying risk levels and choose unobservable security effort. We consider both risk-neutral and risk-averse agents and develop a theoretical framework to derive optimal insurance contracts and security investments. These contracts are designed to alleviate moral hazard and adverse selection under three information scenarios. The theoretical results reveal three main incentive effects: premium discounts promote security effort, more generous coverage weakens the incentive to protect, and protection generated by neighboring firms creates a substitution effect that weakens individual effort. Numerical experiments compare the optimal premium discount, coverage rate, security effort, and the insurer's expected payoff across the three information scenarios.
- cyber risks,
- security investment,
- information asymmetry,
- optimal insurance contracts
Citation: Rong Hu, Na Ren, Xin Zhang. Modeling and pricing cybersecurity insurance with information asymmetry[J]. AIMS Mathematics, 2026, 11(7): 22354-22379. doi: 10.3934/math.2026904

Related Papers:

Abstract

Firms typically invest in security measures to reduce potential losses from cyber incidents. Since such measures cannot fully eliminate cyber risks, cyber insurance plays an important role in hedging residual losses. This paper studies contract design in a monopolistic cyber insurance market where policyholders differ in their underlying risk levels and choose unobservable security effort. We consider both risk-neutral and risk-averse agents and develop a theoretical framework to derive optimal insurance contracts and security investments. These contracts are designed to alleviate moral hazard and adverse selection under three information scenarios. The theoretical results reveal three main incentive effects: premium discounts promote security effort, more generous coverage weakens the incentive to protect, and protection generated by neighboring firms creates a substitution effect that weakens individual effort. Numerical experiments compare the optimal premium discount, coverage rate, security effort, and the insurer's expected payoff across the three information scenarios.

References

[1]	G. A. Akerlof, The market for "lemons": Quality uncertainty and the market mechanism, Quart. J. Econ., 84 (1970), 488–500. http://doi.org/10.2307/1879431 doi: 10.2307/1879431
[2]	R. Anderson, Why information security is hard: An economic perspective, In: Seventeenth Annual Computer Security Applications Conference, 2001,358–365. http://doi.org/10.1109/ACSAC.2001.991552
[3]	K. Awiszus, T. Knispel, I. Penner, G. Svindland, A. Voß, S. Weber, Modeling and pricing cyber insurance, Eur. Actuar. J., 13 (2023), 1–53. http://doi.org/10.1007/s13385-023-00341-9 doi: 10.1007/s13385-023-00341-9
[4]	C. Bravard, L. Charroin, C. Touati, Optimal design and defense of networks under link attacks, J. Math. Econ., 68 (2017), 62–79. http://doi.org/10.1016/j.jmateco.2016.11.006 doi: 10.1016/j.jmateco.2016.11.006
[5]	M. Carannante, V. D'Amato, P. Fersini, S. Forte, G. Melisi, Vine copula modeling dependence among cyber risks: A dangerous regulatory paradox, Appl. Stoch. Model. Bus., 39 (2023), 549–566. http://doi.org/10.1002/asmb.2767 doi: 10.1002/asmb.2767
[6]	H. Cavusoglu, B. Mishra, S. Raghunathan, A model for evaluating IT security investments, Commun. ACM, 47 (2004), 87–92. http://doi.org/10.1145/1005817.1005828 doi: 10.1145/1005817.1005828
[7]	H. Cavusoglu, S. Raghunathan, W. T. Yue, Decision-theoretic and game-theoretic approaches to IT security investment, J. Manage. Inform. Syst., 25 (2008), 281–304. http://doi.org/10.2753/MIS0742-1222250211 doi: 10.2753/MIS0742-1222250211
[8]	P. A. Chiappori, B. Salanié, Testing for asymmetric information in insurance markets, J. Polit. Econ., 108 (2000), 56–78. http://doi.org/10.1086/262111 doi: 10.1086/262111
[9]	W. F. Chong, D. Linders, Z. Quan, L. Zhang, Incident-specific cyber insurance, ASTIN Bulletin., 55 (2025), 395–425. http://doi.org/10.1017/asb.2025.9 doi: 10.1017/asb.2025.9
[10]	L. A. Gordon, M. P. Loeb, T. Sohail, A framework for using insurance for cyber-risk management, Commun. ACM, 46 (2003), 81–85. http://doi.org/10.1145/636772.636774 doi: 10.1145/636772.636774
[11]	H. S. B. Herath, T. C. Herath, Copula-based actuarial model for pricing cyber-insurance policies, Insur. Mark. Companies: Anal. Actuar. Comput., 2 (2011), 7–20.
[12]	C. Hillairet, O. Lopez, L. d'Oultremont, B. Spoorenberg, Cyber-contagion model with network structure applied to insurance, Insur.: Math. Econ., 107 (2022), 88–101. http://doi.org/10.1016/j.insmatheco.2022.08.002 doi: 10.1016/j.insmatheco.2022.08.002
[13]	A. Hofmann, Internalizing externalities of loss prevention through insurance monopoly: An analysis of interdependent risks, Geneva Risk Insur. Rev., 32 (2007), 91–111. http://doi.org/10.1007/s10713-007-0004-2 doi: 10.1007/s10713-007-0004-2
[14]	M. M. Khalili, P. Naghizadeh, M. Liu, Embracing risk dependency in designing cyber-insurance contracts, In: 2017 55th Annual Allerton Conference on Communication, Control, and Computing (Allerton), 2017,926–933. http://doi.org/10.1109/ALLERTON.2017.8262837
[15]	M. M. Khalili, P. Naghizadeh, M. Liu, Designing cyber insurance policies: The role of pre-screening and security interdependence, In: IEEE Transactions on Information Forensics and Security, 13 (2018), 2226–2239. http://doi.org/10.1109/TIFS.2018.2812205
[16]	H. Kunreuther, G. Heal, Interdependent security, J. Risk Uncertainty, 26 (2003), 231–249. http://doi.org/10.1023/A: 1024119208153
[17]	J. Bolot, M. Lelarge, Cyber insurance as an incentive for internet security, In: Managing information risk and the economics of security, Boston, MA: Springer, 2009,269–290. http://doi.org/10.1007/978-0-387-09762-6_13
[18]	M. Lelarge, J. Bolot, Economic incentives to increase security in the internet: The case for insurance, IEEE INFOCOM, 2009, 1494–1502. http://doi.org/10.1109/INFCOM.2009.5062066
[19]	J. A. Ligon, P. D. Thistle, Information asymmetries and informational incentives in monopolistic insurance markets, J. Risk Insur., 63 (1996), 434–459. https://doi.org/10.2307/253620 doi: 10.2307/253620
[20]	J. Liu, J. Li, K. Daly, Bayesian vine copulas for modelling dependence in data breach losses, Ann. Actuar. Sci., 16 (2022), 401–424. http://doi.org/10.1017/S174849952200001X doi: 10.1017/S174849952200001X
[21]	P. Naghizadeh, M. Liu, Voluntary participation in cyber-insurance markets, In: The 13th Workshop on the Economics of Information Security (WEIS), 2014.
[22]	R. Pal, L. Golubchik, Analyzing self-defense investments in internet security under cyber-insurance coverage, In: 2010 IEEE 30th International Conference on Distributed Computing Systems, 2010,339–347. http://doi.org/10.1109/ICDCS.2010.79
[23]	R. Pal, Cyber-insurance in internet security: A dig into the information asymmetry problem, 2012, arXiv: 1202.0884. http://doi.org/10.48550/arXiv.1202.0884
[24]	S. Romanosky, L. Ablon, A. Kuehn, T. Jones, Content analysis of cyber insurance policies: How do carriers write policies and price cyber risk? J. Cybersecurity, 5 (2019), tyz002. http://doi.org/10.1093/cybsec/tyz002
[25]	D. Schatz, R. Bashroush, Economic valuation for information security investment: A systematic literature review, Inform. Syst. Front., 19 (2017), 1205–1228. http://doi.org/10.1007/s10796-016-9648-8 doi: 10.1007/s10796-016-9648-8
[26]	G. Schwartz, S. Sastry, Cyber-insurance framework for large scale interdependent networks, In: HiCoNS '14: Proceedings of the 3rd international conference on High confidence networked systems, 2014,145–154. http://doi.org/10.1145/2566468.2566481
[27]	H. Sun, M. Xu, P. Zhao, Modeling malicious hacking data breach risks, N. Am. Actuar. J., 25 (2021), 484–502. http://doi.org/10.1080/10920277.2020.1752255 doi: 10.1080/10920277.2020.1752255
[28]	H. Varian, System reliability and free riding, In: Economics of information security, Boston, MA: Springer, 12 (2004), 1–15. http://doi.org/10.1007/1-4020-8090-5_1
[29]	M. Vojnovic, A. J. Ganesh, On the race of worms, alerts, and patches, In: EEE/ACM Transactions on Networking, 16 (2008), 1066–1079. http://doi.org/10.1109/TNET.2007.909678
[30]	X. Xie, C. Lee, M. Eling, Cyber insurance offering and performance: An analysis of the U.S. cyber insurance market, Geneva Pap. Risk Insur. Issues Pract., 45 (2020), 690–736. http://doi.org/10.1057/s41288-020-00176-5 doi: 10.1057/s41288-020-00176-5
[31]	M. Xu, K. M. Schweitzer, R. M. Bateman, S. Xu, Modeling and predicting cyber hacking breaches, IEEE T. Inf. Foren. Sec., 13 (2018), 2856–2871. http://doi.org/10.1109/TIFS.2018.2834227 doi: 10.1109/TIFS.2018.2834227
[32]	M. Xu, L. Hua, Cybersecurity insurance: Modeling and pricing, N. Am. Actuar. J., 23 (2019), 220–249. http://doi.org/10.1080/10920277.2019.1566076 doi: 10.1080/10920277.2019.1566076
[33]	Z. Yang, J. C. S. Lui, Security adoption and influence of cyber-insurance markets in heterogeneous networks, Perform. Evaluation, 74 (2014), 1–17. http://doi.org/10.1016/j.peva.2013.10.003 doi: 10.1016/j.peva.2013.10.003

Reader Comments

Your name:*

Email:*
© 2026 the Author(s), licensee AIMS Press. This is an open access article distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/by/4.0)