Cyber Risk Modeling Using a Two-phase Hawkes Process with External Excitation

With the growing digital transformation of the worldwide economy, cyber risk has become a major issue. As 1% of the world’s GDP (around $1,000 billion) is allegedly lost to cybercrime every year, IT systems continue to get increasingly interconnected, making them vulnerable to accumulation phenomena that undermine the pooling mechanism of insurance. As highlighted in the literature, Hawkes processes appear to be suitable models to capture contagion phenomena and clustering features of cyber events. We extend the standard Hawkes modeling of cyber risk frequency by adding external shocks, modelled by the publication of cyber vulnerabilities that are deemed to increase the likelihood of attacks in the short term.  The aim of the proposed model is to provide a better quantification of contagion effects since, while the standard Hawkes model allocates all the clustering phenomena to self-excitation, our model allows to capture the external common factors that may explain part of the systemic pattern.  We develop and compare calibration procedures of this model and demonstrate that the external factors driven by vulnerabilities are key to understanding cyber attacks dynamics. We then present simulation case study based on the two-phase version of the Hawkes model under which we explore various scenarios related to insurer reaction measures and exhibit optimal mitigation strategies.