The supply of cyber risk insurance

Cyber risk losses are large and growing, yet the cyber insurance market is small.
What constraints the insurance industry from providing larger capacity for cyber
risk? We argue that cyber risk is special in that it combines heavy tails, uncertain
loss distribution, and asymmetric information. We model the implications of these
risk features for risk financing and then test them empirically in the context of the US
cyber insurance market. Using an exogenous shock of the non-US affiliated reinsurance
tax treatment in 2017, we establish the causal inference that insurers primarily
rely on the internal capital market to supply cyber risk insurance. Then, we test
which of the features of cyber risk contribute to the cost of external capital and
confirm that all of them play a significant role.