{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T15:38:57Z","timestamp":1781019537243,"version":"3.54.1"},"reference-count":30,"publisher":"Oxford University Press (OUP)","issue":"1","license":[{"start":{"date-parts":[[2019,10,20]],"date-time":"2019-10-20T00:00:00Z","timestamp":1571529600000},"content-version":"vor","delay-in-days":292,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"funder":[{"DOI":"10.13039\/100006602","name":"Air Force Research Laboratory","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100006602","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Department of Homeland Security (DHS) Office of S&T","award":["FA8750-18-2-0011"],"award-info":[{"award-number":["FA8750-18-2-0011"]}]},{"name":"Air Force Research Laboratory and Department of Homeland Security (DHS) Office of S&T"},{"name":"National Science Foundation","award":["CNS-1422211"],"award-info":[{"award-number":["CNS-1422211"]}]},{"name":"National Science Foundation","award":["CNS-1616575"],"award-info":[{"award-number":["CNS-1616575"]}]},{"name":"National Science Foundation","award":["CNS-1739517"],"award-info":[{"award-number":["CNS-1739517"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019,1,1]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>This article highlights how cyber risk dependencies can be taken into consideration when underwriting cyber-insurance policies. This is done within the context of a base rate insurance policy framework, which is widely used in practice. Specifically, we show that there is an opportunity for an underwriter to better control the risk dependency and the risk spill-over, ultimately resulting in lower overall cyber risks across its portfolio. To do so, we consider a Service Provider (SP) and its customers as the interdependent insurer\u2019s customers: a data breach suffered by the SP can cause business interruption to its customers. In underwriting both the SP and its customers, we show that the insurer can increase its profit by incentivizing the SP (through a discount on its premium) to invest more in security, thereby decreasing the chance of business interruption to the customers, and increasing social welfare. For comparison, we also consider a scenario where the insurer underwrites only the SP\u2019s customers (but not the SP), and receives compensation from the SP\u2019s insurance carrier when losses are attributed to the SP. We show how the insurer\u2019s best strategy is to underwrite both the SP and its customers. We use an actual cyber-insurance policy and claims data to calibrate and substantiate our analytical findings.<\/jats:p>","DOI":"10.1093\/cybsec\/tyz010","type":"journal-article","created":{"date-parts":[[2019,10,20]],"date-time":"2019-10-20T10:09:06Z","timestamp":1571566146000},"source":"Crossref","is-referenced-by-count":18,"title":["Embracing and controlling risk dependency in cyber-insurance policy underwriting"],"prefix":"10.1093","volume":"5","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4223-3254","authenticated-orcid":false,"given":"Mohammad Mahdi","family":"Khalili","sequence":"first","affiliation":[{"name":"Department of Electrical Engineering and Computer Science, University of Michigan, Ann Arbor, MI 48109, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mingyan","family":"Liu","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering and Computer Science, University of Michigan, Ann Arbor, MI 48109, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sasha","family":"Romanosky","sequence":"additional","affiliation":[{"name":"RAND Corporation, Arlington, VA 22202, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"286","published-online":{"date-parts":[[2019,10,20]]},"reference":[{"key":"2019102006090222100_tyz010-B1","volume-title":"Journal of Cybersecurity","author":"Romanosky","year":"2019"},{"key":"2019102006090222100_tyz010-B2","author":"Vakilinia","year":"2018"},{"key":"2019102006090222100_tyz010-B3","doi-asserted-by":"crossref","first-page":"519","DOI":"10.1007\/978-3-319-68711-7_28","volume-title":"Decision and Game Theory for Security","author":"Tosh","year":"2017"},{"key":"2019102006090222100_tyz010-B4","first-page":"1","author":"Hoang","year":"2017"},{"key":"2019102006090222100_tyz010-B5","author":"B\u00f6hme","year":"2010"},{"key":"2019102006090222100_tyz010-B6","first-page":"1","author":"Pal","year":"2013"},{"key":"2019102006090222100_tyz010-B7","author":"Vakilinia","year":"2018"},{"key":"2019102006090222100_tyz010-B8","year":"2016"},{"key":"2019102006090222100_tyz010-B9","first-page":"252","author":"Miura-Ko","year":"2008"},{"key":"2019102006090222100_tyz010-B10","first-page":"588","volume-title":"European Symposium on Research in Computer Security","author":"Johnson","year":"2010"},{"key":"2019102006090222100_tyz010-B11","doi-asserted-by":"crossref","first-page":"234","DOI":"10.1007\/978-3-642-17197-0_16","volume-title":"International Conference on Decision and Game Theory for Security","author":"Johnson","year":"2010"},{"key":"2019102006090222100_tyz010-B12","doi-asserted-by":"crossref","first-page":"86","DOI":"10.1007\/978-3-319-67540-4_8","volume-title":"Game Theory for Networks: 7th International EAI Conference, GameNets 2017 Knoxville, TN, USA, May 9, 2017, Proceedings","author":"Farhadi","year":"2017"},{"key":"2019102006090222100_tyz010-B13","author":"Hasheminasab"},{"key":"2019102006090222100_tyz010-B14","author":"Ezhei","year":"2018"},{"key":"2019102006090222100_tyz010-B15","doi-asserted-by":"crossref","first-page":"2484","DOI":"10.1109\/TNET.2017.2691605","article-title":"Effects of degree correlations in interdependent security: good or bad?","volume":"25","author":"La","year":"2017","journal-title":"IEEE\/ACM Transactions on Networking"},{"key":"2019102006090222100_tyz010-B16","first-page":"349","volume-title":"Decision and Game Theory for Security: 7th International Conference, GameSec 2016, New York, NY, USA, November 2\u20134, 2016, Proceedings","author":"Laszka","year":"2016"},{"key":"2019102006090222100_tyz010-B17","doi-asserted-by":"crossref","DOI":"10.1057\/s41288-018-0078-3","article-title":"Reducing informational disadvantages to improve cyber risk management","author":"Shetty","year":"2018","journal-title":"The Geneva Papers on Risk and Insurance - Issues and Practice"},{"key":"2019102006090222100_tyz010-B18","doi-asserted-by":"crossref","first-page":"231","DOI":"10.1023\/A:1024119208153","article-title":"Interdependent security","volume":"26","author":"Kunreuther","year":"2003","journal-title":"J. Risk Uncertainty"},{"key":"2019102006090222100_tyz010-B19","author":"Strickland"},{"key":"2019102006090222100_tyz010-B20","doi-asserted-by":"crossref","first-page":"2210","DOI":"10.1109\/JSAC.2012.121213","article-title":"Coordination in network security games: a monotone comparative statics approach","volume":"30","author":"Lelarge","year":"2012","journal-title":"IEEE J. Select Areas Commun"},{"key":"2019102006090222100_tyz010-B21","doi-asserted-by":"crossref","first-page":"123","DOI":"10.2753\/MIS0742-1222300104","article-title":"Managing interdependent information security risks: cyberinsurance, managed security services, and risk pooling arrangements","volume":"30","author":"Zhao","year":"2013","journal-title":"J Manage Inform Syst"},{"key":"2019102006090222100_tyz010-B22","doi-asserted-by":"crossref","first-page":"1378","DOI":"10.1109\/TNET.2015.2408598","article-title":"Interdependent security with strategic agents and cascades of infection","volume":"24","author":"La","year":"2016","journal-title":"IEEE\/ACM Trans Networking"},{"key":"2019102006090222100_tyz010-B23","doi-asserted-by":"crossref","first-page":"497","DOI":"10.1111\/j.1539-6924.2010.01478.x","article-title":"Cyber security risk management: public policy implications of correlated risk, imperfect ability to prove loss, and observability of self protection","volume":"31","author":"Ogut","journal-title":"Risk Analysis"},{"key":"2019102006090222100_tyz010-B24","doi-asserted-by":"crossref","first-page":"2226","DOI":"10.1109\/TIFS.2018.2812205","article-title":"Designing cyber insurance policies: the role of pre-screening and security interdependence","volume":"13","author":"Khalili","year":"2018","journal-title":"IEEE Trans. Inform. Forensics Security"},{"key":"2019102006090222100_tyz010-B25","author":"Khalili","year":"2017"},{"key":"2019102006090222100_tyz010-B26","doi-asserted-by":"crossref","first-page":"549","DOI":"10.1109\/TNET.2010.2071397","article-title":"How bad are selfish investments in network security?","volume":"19","author":"Jiang","year":"2011","journal-title":"IEEE\/ACM Trans. Networking"},{"key":"2019102006090222100_tyz010-B27","author":"Massacci","year":"2017"},{"key":"2019102006090222100_tyz010-B28","first-page":"1","author":"Pal","year":"2017"},{"key":"2019102006090222100_tyz010-B29","author":"Evelsizer","year":"2016"},{"key":"2019102006090222100_tyz010-B30"}],"container-title":["Journal of Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/academic.oup.com\/cybersecurity\/article-pdf\/5\/1\/tyz010\/30247290\/tyz010.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"http:\/\/academic.oup.com\/cybersecurity\/article-pdf\/5\/1\/tyz010\/30247290\/tyz010.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,5,22]],"date-time":"2020-05-22T03:41:25Z","timestamp":1590118885000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article\/doi\/10.1093\/cybsec\/tyz010\/5601219"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,1,1]]},"references-count":30,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2019,1,1]]}},"URL":"https:\/\/doi.org\/10.1093\/cybsec\/tyz010","relation":{},"ISSN":["2057-2085","2057-2093"],"issn-type":[{"value":"2057-2085","type":"print"},{"value":"2057-2093","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2019]]},"published":{"date-parts":[[2019,1,1]]},"article-number":"tyz010"}}