The changing landscape of cyber risk: An empirical analysis of loss severity and tail dynamics

Cyber risk poses severe challenges to the society and has become an important theme in risk management and insurance. Yet its statistical features and evolution over time are not sufficiently understood. This paper focuses on two key dimensions of cyber risk-loss severity and tail risk-using three different cyber loss databases. We first focus on the dynamics of loss severity, identifying structural shifts in distributions through a Fréchet-based change point detection method and applying inverse probability weighting to control for selection bias. Our results indicate an increase in the severity of malicious cyber losses since 2018, whereas negligent incidents do not follow the same trend. We then propose methods that combine tail index estimation and change point detection, finding that cyber loss distributions remain heavy-tailed over time, despite heterogeneity across different risk categories. Finally, we present a numerical analysis to illustrate how losses of a simulated cyber insurance portfolio evolve over time, emphasizing the importance of incorporating the dynamic properties of cyber risk into pricing strategies for insurance companies.