Systemic Cyber Risk: Linking Measurement, Market Incentives, and Policy

Few would dispute that systemic (catastrophic) cyber risk is a very serious problem for the global economy and for society, and that catastrophic failures with very serious consequences are likely, with recent advances in artificial intelligence (AI) only magnifying the ability of attackers to breach our defenses. However, there is a “disconnect†between a high-level acknowledgment of the problem and actions taken by firms and policymakers to address the problem. In this paper, we develop a more nuanced framework that shines a spotlight on the forces behind the lack of action as well as on key areas of focus for policy, areas where the societal benefits to action are greatest and areas where we might better harness economic incentives to improve outcomes. By “shaping†markets using incentives, carefully crafted regulatory frameworks, and the provision of digital public goods, policy makers can channel market forces and better align incentives to get substantially better cybersecurity outcomes while simultaneously reducing entry barriers for firms in the cybersecurity sector, firms in the defense sector, and in industry more broadly.