The Nature of Losses from Cyber-Related Events: Risk Categories and Business Sectors

Pavel V. Shevchenko, Jiwook Jang, Matteo Malavasi, Gareth W. Peters, Georgy Sofronov and Stefan Tr\"uck
Additional contact information
Pavel V. Shevchenko: Department of Actuarial Studies and Business Analytics, Macquarie Business School, Macquarie University, Sydney, Australia
Jiwook Jang: Department of Actuarial Studies and Business Analytics, Macquarie Business School, Macquarie University, Sydney, Australia
Matteo Malavasi: Department of Actuarial Studies and Business Analytics, Macquarie Business School, Macquarie University, Sydney, Australia
Gareth W. Peters: Department of Statistics and Applied Probability, College of Letters and Science, University of California Santa Barbara, Santa Barbara, California USA
Georgy Sofronov: School of Mathematical and Physical Sciences, Faculty of Science and Engineering, Macquarie University, Sydney, Australia
Stefan Tr\"uck: Department of Actuarial Studies and Business Analytics, Macquarie Business School, Macquarie University, Sydney, Australia

Papers from arXiv.org

Abstract: In this study we examine the nature of losses from cyber related events across different risk categories and business sectors. Using a leading industry dataset of cyber events, we evaluate the relationship between the frequency and severity of individual cyber-related events and the number of affected records. We find that the frequency of reported cyber related events has substantially increased between 2008 and 2016. Furthermore, the frequency and severity of losses depend on the business sector and type of cyber threat: the most significant cyber loss event categories, by number of events, were related to data breaches and the unauthorized disclosure of data, while cyber extortion, phishing, spoofing and other social engineering practices showed substantial growth rates. Interestingly, we do not find a distinct pattern between the frequency of events, the loss severity, and the number of affected records as often alluded to in the literature. We also analyse the severity distribution of cyber related events across all risk categories and business sectors. This analysis reveals that cyber risks are heavy-tailed, i.e., cyber risk events have a higher probability to produce extreme losses than events whose severity follows an exponential distribution. Furthermore, we find that the frequency and severity of cyber related losses exhibits a very dynamic and time varying nature.

Date: 2022-02, Revised 2022-03
New Economics Papers: this item is included in nep-rmg
References: View references in EconPapers View complete reference list from CitEc
Citations:

Downloads: (external link)
http://arxiv.org/pdf/2202.10189 Latest version (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:arx:papers:2202.10189

Access Statistics for this paper

More papers in Papers from arXiv.org
Bibliographic data for series maintained by arXiv administrators ().