N°23-118: The Supply of Cyber Risk Insurance

Cyber risk losses are large and growing, yet the cyber insurance market is small. What constraints the insurance industry from providing larger capacity for cyber risk? We argue that cyber risk is special in that it combines heavy tails, uncertain loss distribution, and asymmetric information. We model the implications of these risk features for risk financing and then test them empirically in the context of the US cyber insurance market. Using an exogenous shock of the non-US affiliated reinsurance tax treatment in 2017, we establish the causal inference that insurers primarily rely on the internal capital market to supply cyber risk insurance. Then, we test which of the features of cyber risk contribute to the cost of external capital and confirm that all of them play a significant role.