Time dynamics of cyber risk

This is the first paper to jointly analyze the three main cyber loss datasets (Advisen, SAS
OpRisk and PRC), yielding the most comprehensive cyber loss data yet considered in the
literature. We first study the problem of report delay bias by applying a two-stage model
and document a faster rate of increase for cyber risk frequency compared with the original
data. Based on these results, we then focus on the time dynamics of cyber risk frequency
and severity, where we separately study the properties of full distribution and tail of loss
severity. We find the loss distribution of cyber events shifts leftwards for both monetary
loss and non-monetary loss (such as accounts/records breached) in the recent period, but
the trend of tail risk is different for these two types of loss. The tail risk of non-monetary
loss is increasing, while the other is not, although they both exhibit heavy-tailedness over
time. Our results are important for cyber risk management and understanding the insura-
bility of cyber risk