Monte Carlo methods to investigate how aggregated cyber insurance claims data impacts security investments

There is evidence that the availability of cyber insurance is contingent on an applicant’s security posture and that premium discounts may apply if the applicant adopts security controls dictated by the insurer. As the cyber insurance market grows in size, questions arise regarding how this situation will affect investment in information security. We investigate how aggregated claims data impacts investments in information security. Monte Carlo methods are used to explore three possible insurer strategies in guiding the policyholder’s investments. The results suggest that aggregated claims data can increase the net revenue of all firms, particularly in cases of low security investment or high uncertainty, but these benefits are contingent on the insureds employing diverse defensive configurations.