# Using Financial Instruments to Transfer the Information Security Risks
## 7 Demonstration: An Example Application
### Information Security Futures
#### 7.4.4 Risk Hedging  
The car manufacturer can hedge its risk, _i.e._, the software vulnerabilities leading to car sales falling short of 10,000, by entering into a \"futures\" contract with a counterparty. In the given scenario, there are many possible state of events, ten events for every 1000 cars falling short of strike of 10,000 cars and \"\(k\)\" number of states for every 1000 cars sold above the strike of 10,000 cars. For the demonstration, we consider the three possible states of events, as shown in Table 21.  
(1) Risk Analysis and Impact Estimation  
We assume that these \"state\" risks have been modeled and the outcome of the CVaR model for the company is as shown in Table 22.  
On the other hand, the market (other participant's) estimates the risk probability and impact as shown in Table 23. \begin{table}
\begin{tabular}{c c c} \hline \hline
**State** & **Event Probability** & **Impact Value** \\ \hline S\({}_{1}\) & 50\% & \$0 \\ \hline S\({}_{2}\) & 35\% & \(-\)$100,000 \\ \hline S\({}_{3}\) & 15\% & \(+\)$150,000 \\ \hline \end{tabular}
\end{table} 
Table 22: Outcome of CVaR Model on Event Probabilities and Impact. \begin{table}
\begin{tabular}{c c c} \hline \hline
**State** & **Event Probability** & **Impact Value** \\ \hline S\({}_{1}\) & 30\% & \$0 \\ \hline S\({}_{2}\) & 55\% & \(-\)$100,000 \\ \hline S\({}_{3}\) & 15\% & \(+\)$150,000 \\ \hline \end{tabular}
\end{table} 
Table 23: Market’s Estimate of Loss Probabilities and Impact. \begin{table}
\begin{tabular}{c c c} \hline \hline
**State** & **Event Probability** & **Impact Value** \\ \hline S\({}_{1}\) & 30\% & \$0 \\ \hline S\({}_{2}\) & 55\% & \(-\)$100,000 \\ \hline S\({}_{3}\) & 15\% & \(+\)$150,000 \\ \hline \end{tabular}
\end{table} 
Table 20: _Cont._ \begin{table}
\begin{tabular}{c c c} \hline \hline
**Participant** & **Trading Side** & **Incentive/Motivation** \\ \hline Cyber-Security Researchers & Buy/Sell & Security researchers in possession of some relevant information may participate in trading of the contract. However, they may like to participate in trading of the contract which is related to the vulnerability discovery in the said product. Trading in that particular contract would allow them to “responsibly” disclose the vulnerability to the car manufacturer “\(M\)”. \\ \hline Cyber-(Re)Insurer & Buy/Sell & To hedge their risk or to profit from trading in the contract. The buy or sell decision depends upon insurer’s risk portfolio. \\ \hline Speculators & Buy/Sell & To diversify their investment portfolio. \\ \hline \end{tabular}
\end{table} 
Table 20: _Cont._ \begin{table}
\begin{tabular}{c c} \hline \hline
**State** & **State Description** \\ \hline S\({}_{1}\) & Number of cars sold by the end of 31 December 2016 is 10,000 \\ \hline S\({}_{2}\) & Number of cars sold by the end of 31 December 2016 is 9000 (less than 10,000) \\ \hline S\({}_{3}\) & Number of cars sold by the end of 31 December 2016 is 11,000 (more than 10,000) \\ \hline \end{tabular}
\end{table} 
Table 21: Possible States of Events for the ISS Contract. (2) Risk Response  
In the given scenario, the car manufacturer may decide to hedge the risk by purchasing the futures contracts. The future contract is structured such that the counterparty pays $1000 to the buyer (car manufacturer) for every 1000 cars which fall short of the strike value and the investor pays $1000 to the counterparty for each 1000 cars which exceeds the strike value. (2.1) Unhedged Scenario  
Based on the market's probability estimate for the three states, the expected future value for the company in an unhedged situation can be calculated as shown in Equation (63).