Competitive Security Pricing in Cyber-Insurance Market: A Game-Theoretic Analysis

摘要

Cyber-insurance has been employed as the mean to transfer cyber risks to an insurance company, i.e., insurer. Thereby the users are covered by the insurance to alleviate the loss from cyber threats. In this work, we consider the security vendors (e.g., Symantec) as cyber-insurers selling cyber-insurance in the market. Security service will be attached to the cyber-insurance by the cyber-insurers for the purpose to reduce the probability of paying claims, where the security level of the security service is measured as the security quality. Our proposed model consists of two stages, i.e., the Stackelberg game. In the first stage, cyber-insurers set the price of cyber-insurance charging to the users while security service will be attached to these cyber-insurance. In the second stage, the users decide on the amount of these cyber-insurances to purchase based on the observed prices and the qualities of the security service. The existence and uniqueness for the equilibrium of the Stackelberg game are validated analytically. The performance evaluation presents some interesting results. For example, the cyber-insurer, who provides the security service with higher quality than other cyber-insurers, earns more profit in the market with strong interdependency than that in the market with weak interdependency while other cyber-insurers earn less profit simultaneously. This is due to the fact that the users can be influenced more easily by their peers, when one cyber-insurer provides the security service with higher quality, it can attract more users easily and be more competitive.