Cloud failure and cyber insurance: calibration of stress scenarios and diversification

The expansion of the cyber insurance market remains exposed to the threat of accumulation events that could simultaneously affect a large number of policyholders. Although few such catastrophes have been observed so far, apart from worldwide cyberattacks such as WannaCry and NotPetya in 2017, the nature of cyber risk makes their occurrence plausible. Stress-testing tools are therefore needed to assess whether an insurance portfolio can withstand such crises. In this perspective, the European Insurance and Occupational Pensions Authority (EIOPA) has identified cloud outage as one of the key scenarios to consider in cyber insurance stress-testing frameworks. In this paper, we propose a framework to model and calibrate cloud-outage scenarios and to measure the diversification of a cyber insurance portfolio. We also show how this diversification can protect against accumulation risk and provide underwriting guidelines to reduce the vulnerability of a portfolio to cloud-outage scenarios.