The impact of extreme cyber events on capital markets and insurers’ asset portfolios

We study the extent to which extreme cyber-risk events affect capital markets and propose a concrete model framework that might be implemented in internal risk models of insurance companies. The literature on disaster risks looks at extreme scenarios in an area of 15% or larger decline in GDP (world wars, financial crises), while the cyber scenarios discussed in the literature are typically of smaller magnitude, i.e., up to 2% of GDP; only some very extreme cyber scenarios go up to 10% of GDP. To empirically analyze the relationship between extreme cyber risk events and capital markets, we implemented two models: a simple model based on historical data showing an impact of up to -4.26% on an insurer’s assets for a stylized asset portfolio in two predefined cyber scenarios and an extended model in which we additionally implement the response of monetary policy and a consumption-based stock market response function. The latter model provides economically more sound estimators for the central parameters of interest (risk-free interest rate, credit spreads, stock returns, etc.) and shows an impact of up to -1.99% for the stylized insurer’s asset portfolio. We conclude that the impact of extreme cyber risk events on capital markets exists so long as the asset side of insurance companies remains limited, which is mainly due to the hedging properties of different asset classes.