Cyber risk and insurance coverage: an actuarial multistate approach

This paper aims at suggesting a possible alternative, original and supplementary (that is, it does not replace nor keep out those standard procedures which have become legal obligations) solution to the issue of network security, whatever the connection tool may be. Both in privately-owned concerns and in public administration as well, the procedures regulating activities of prevention, analysis and management of any cyber-attack (known as cyber risk as well as, in more serious cases when individual is involved, cyber-crime) are increasingly numerous. Hereinafter, a terminal is referred to as any device that can be connected to the web (via the Internet and/or Intranet). Therefore, this paper does not aim at suggesting a technological solution – a specific task for antivirus programmer – but at formulating the actuarial premises for coverage in case of cyber damage, also known as cyber-insurance. On the analogy of the coverage regarding health insurance and following an actuarial multistate approach, three levels of damage will be identified with regard to the functionality of the terminal. We have hypothesized two typologies of computer policies: ADC (Activities of Daily Cyber) and GCU (Good Cyber Use).