# Using Financial Instruments to Transfer the Information Security Risks
## 7 Demonstration: An Example Application
### Information Security Swaps
#### 7.3.4 Risk Hedging
\[\alpha_{c}=(\rho_{s1}*\mu_{u1})+(\rho_{s2}*\mu_{u2})+(\rho_{s3}*\mu_{u3})+(\rho_ {s4}*\mu_{u4}) \tag{51}\]  
where, \(\alpha_{c}\) is the company's unhedged expected future value, \(\rho_{s1}\) is the probability of \(s_{1}\), \(\mu_{u1}\) is the impact value (unhedged) for state 1, \(\rho_{s2}\) is the probability of \(s_{2}\), \(\mu_{u2}\) is the impact value (unhedged) for state 2, \(\rho_{s3}\) is the probability of \(s_{3}\), \(\mu_{u3}\) is the impact value (unhedged) for state 3, \(\rho_{s4}\) is the probability of \(s_{4}\), and \(\mu_{u4}\) is the impact value (unhedged) for state 4. The expected future value from the company's perspective in an unhedged scenario is shown in Figure 15, and calculated as shown in Equation (52). \[\alpha_{c}=(60\%*0)+(25\%*(-\$150,000))+(10\%*(-\$350,000))+(5\%*(-\$500,000 ))=-\$97,500 \tag{52}\] \begin{table}
\begin{tabular}{c c c} \hline \hline
**State** & **Loss Probability** & **Impact Value** \\ \hline S\({}_{1}\) & 80\% & \$0 \\ \hline S\({}_{2}\) & 10\% & \(-\$150,000\) \\ \hline S\({}_{3}\) & 8\% & \(-\$350,000\) \\ \hline S\({}_{4}\) & 2\% & \(-\$500,000\) \\ \hline \hline \end{tabular}
\end{table} 
Table 18: Counterparty’s Estimate of Event Probabilities and Impact. Figure 15: Unhedged Expected Future Value for Company’s Probability Estimate. The counterparty's (seller's) expected future value in an unhedged scenario can be expressed as in Equation (53). \[\alpha_{s}=(\rho_{s1}*\mu_{u1})+(\rho_{s2}*\mu_{u2})+(\rho_{s3}*\mu_{u3})+(\rho_{ s4}*\mu_{u4}) \tag{53}\]  
where, \(\alpha_{s}\) is the company's unhedged expected future value, \(\rho_{s1}\) is the probability of \(s_{1}\), \(\mu_{u1}\) is the impact value (unhedged) for state 1, \(\rho_{s2}\) is the probability of \(s_{2}\), \(\mu_{u2}\) is the impact value (unhedged) for state 2, \(\rho_{s3}\) is the probability of \(s_{3}\), \(\mu_{u3}\) is the impact value (unhedged) for state 3, \(\rho_{s4}\) is the probability of \(s_{4}\), and \(\mu_{u4}\) is the impact value (unhedged) for state 4. The expected future value from the counterparty's perspective in an unhedged scenario is shown in Figure 16, and calculated as shown in Equation (54). \[\alpha_{s}=(80\%*0)+(10\%*(-\$150,000))+(8\%*(-\$350,000))+(2\%*(-\$500,000) )=-\$53,000 \tag{54}\]  
Thus, if the satellite service provider remains unhedged and the satellite services are interrupted due to a cyber-attack then the company would suffer a significant financial loss, $97,500 (company's expected future value), $53,000 (counterparty's expected future value). (2.2) Hedged Scenario  
If the satellite service provider enters into a swap contract to cover the risk upto $500,000, then the company is perfectly hedged for the impact upto $500,000. We demonstrate and assess the application of ISS for an impact of $500,000. Therefore, using Equation 28 the hedge ratio for the company in the given scenario is 1.  
\[\text{(For a perfect hedge, hedge ratio is 1)}=>1=\frac{(\omega*500,000)-0}{500,000} \tag{55}\]  
In the above equation, we have ignored the premium paid for the ISS to emphasize that the one ISS contract is sufficient to cover the impact upto $500,000. If premium cost, $10,000 (2% of $500,000) is taken into consideration the \(\omega\) value will be a fractional value, however as the ISS is not divided into several smaller value contract, the ISS can only be purchased as one contract to cover the underlying risk. Figure 16: Unedged Expected Future Value for Counterparty’s Probability Estimate. Therefore, as shown in Equation (56), with the maximum payout of $500,000 per contract, the company needs to purchase only one ISS contract to perfectly hedge its risk impact of $500,000. We use the Equation (31) to do an ex-ante assessment of hedge effectiveness, computed as in Equation (57). Figure 15:0  
Thus, the hedge strategy formed with ISS contract is expected to be 98.04% effective in mitigating the impact of an information security event adversely affecting the services of the satellite company.