# Using Financial Instruments to Transfer the Information Security Risks
## 6 Design Specifications for Information Security Derivatives
### ISD Design Process
#### 6.2.4 Pricing of ISD  
The pricing of ISD would be more like the pricing of weather derivatives and economic derivatives than the standard pricing models such as Black-Scholes pricing model Black-Scholes (1963). Like economic derivatives, the payout formula for an ISD would depend on the occurrence or non-occurrence of the underlying event, instead of variance in price of an underlying asset. Thus, the price modeling would not be based on a continuous variable with a standard distribution. In other words, the probability of (non-)occurrence of the underlying event is not a tradeable asset nor it can be linked to one. The payout from the ISD cannot be hedged through a dynamic trading strategy. Thus, the key issue in the pricing of ISD is the non-hedgeability of the payout trigger, such as a discovery of a vulnerability in a piece of software. These issues are well-known to the option modelers. It is common to find options in exotic fixed income and credit derivatives that are modeled on directly unhedgeable variables. Some of these methods can be applied in pricing of ISD on variables that can be postulated to have known statistical or functional relationship to the underlying risk. In general, there can be three approaches to price the ISD, however they are yet to be explored by research, and briefly discussed as follows:  
_(i) Business Pricing:_ Business pricing requires the organization interested in using an ISD, to model the financial impact of an information security event across a variety of outcomes (states). Then the organization can determine the amount it is willing to pay (as premium) to protect the business against those adverse conditions (states) in case they occurred based on the output of CVaR model [83] and risk appetite of the organization. In this way, an organization can obtain a \"guaranteed security\" for the desired period, greatly reducing the variations in revenue and/or expenses due to an information security event. Alternatively, the counterparty seeking a certain level of return for assuming a certain level of risk can determine the price (premium) that it wants to charge to bear the expected outcome of the underlying information security event. _(ii) Actuarial (Historical) Pricing:_ The historical pricing method is based on the computation of future expectations. Like economic derivatives [5], the actuarial pricing method can be applied to the underlying information security variables that can be observed over time. Similar to economic variables, the information security variables cannot be bought or sold to hedge against the future payout of the derivative contract with the said variable as underlying. Like an inflation index for economic derivatives, an information security index can be treated as a continuous variable, however as the hedge argument for the complete market does not apply, the martingale transformation cannot be used to calculate the present value of the hedge cost. The properties of an information security variable is empirically researched to come up with parametric or numerical distribution of possible outcomes. In other words, the objective is to estimate subjective or historical means and variances, and solve for the in-the-money probability using the untransformed distribution. This would result in the following equation [5]:  
\[P_{B}=V_{O}*e^{-rt}*P_{r}(Variable>K) \tag{18}\]  
where, \(P_{B}\) is the price of the binary option (with two states), \(V_{O}\) is the value of the option (expected payout), \(r\) is the interest rate, \(t\) is the time to expiry of the contract, \(P_{r}\) is the untransformed probability distribution (subjective cumulative probability of exceeding the strike), and \(K\) is the strike level. The price is not equal to the present value of the hedge. It is the discounted value of a statistical expectation of the payoff. It is only good on average, and to the level that the distribution assumptions are right.