Stress scenarios of cyber loss processes with dependencies

Cyber risk has become one of the most critical threats to organizations, characterized by its contagious nature and its dependence on vulnerability disclosures. These features make it particularly challenging for insurers to quantify systemic exposures and design stress tests that assess portfolio resilience under extreme scenarios. In this paper, we develop a model that explicitly incorporates the role of vulnerabilities in cyber attack dynamics and captures contagion and clustering features. Using the general framework of Multivariate Self-Exciting Processes with Dependencies (MSPD), we provide closed-form expressions for the expectation and the variance of a cyber loss process under an externally excited Hawkes model, and we derive closed-form formulas for the surplus under two stress scenarios: (i) an excess of claims in the portfolio and (ii) a massive disclosure of critical vulnerabilities. This novel approach enables trajectory-based stress tests by evaluating the loss process under deterministic scenarios of claims or vulnerability disclosures. By quantifying the impact of these scenarios, our framework offers insurers practical tools for cyber risk stress testing, portfolio management, and regulatory compliance.