Michael Fortmann’s research while affiliated with Technische Hochschule Köln and other places

Cybersecurity requires an effective risk transfer regime and a well‐functioning insurance market to improve stakeholder resilience. However, rapid cyber threat adaptation, limited data availability, and inadequate risk understanding pose significant challenges for the insurance industry and its customers. This research uses a mixed methods approach to analyze the inclusions, exclusions, and suitability of current cyber policies in the German cyber insurance market. The study analyzes 41 cyber insurance policies, representing about 80% of the German cyber insurance market. This examination is supported by semistructured interviews with 23 cyber insurance experts. The authors find that there are no standardized cyber policy wordings, and insurers use different terms and definitions in their insurance policies. Specifically, the results show a significant lack of clarity around coverages and exclusions. This research contributes to the cybersecurity risk management community and will enable businesses, insurance companies, and policymakers to better understand, measure, and manage cyber risk.

Diversification plays a pivotal role under the risk-based capital regime of Solvency II. The new rules reward large and well-diversified insurance companies with relatively low capital requirements compared to those of small and specialised nature. To enhance diversification, insurance companies can adjust their strategy by engaging in mergers and acquisitions or new market entries. Alternatively, insurers can accept higher Solvency II capital requirements, displaying a competitive disadvantage and impeding future growth. This research proposes a Solvency II portfolio swap as a new diversification solution that allows small and specialised insurance companies to improve their diversification, and thus, mitigate their diversification disadvantage. The effect of such swaps is demonstrated through the use of two hypothetical insurance companies by swapping 20% of their portfolio over four different scenarios. The swap allowed for a 6% reduction in the Solvency Capital Requirement (SCR) and a maximum increase of the SCR coverage ratio of 17%. With Solvency II posited to stimulate further mergers and acquisitions within the European insurance market, this paper offers an alternative method for insurers to diversify their portfolio. Furthermore, it is suggested that the proposed alternative risk transfer method may improve insurance market competition within the EU by facilitating small and specialised insurers’ competitiveness.

Cybercrime is estimated to have cost the global economy just under USD 1 trillion in 2020, indicating an increase of more than 50% since 2018. With the average cyber insurance claim rising from USD 145,000 in 2019 to USD 359,000 in 2020, there is a growing necessity for better cyber information sources, standardised databases, mandatory reporting and public awareness. This research analyses the extant academic and industry literature on cybersecurity and cyber risk management with a particular focus on data availability. From a preliminary search resulting in 5219 cyber peer-reviewed studies, the application of the systematic methodology resulted in 79 unique datasets. We posit that the lack of available data on cyber risk poses a serious problem for stakeholders seeking to tackle this issue. In particular, we identify a lacuna in open databases that undermine collective endeavours to better manage this set of risks. The resulting data evaluation and categorisation will support cybersecurity researchers and the insurance industry in their efforts to comprehend, metricise and manage cyber risks. Supplementary information: The online version contains supplementary material available at 10.1057/s41288-022-00266-6.