# Using Financial Instruments to Transfer the Information Security Risks
## 4 Problem Elicitation
There is a lack of historical cyber-incidents data which limits the variety of cyber-insurance products and cyber-insurer's are exposed to a risk of insolvency due to interconnected and high impact nature of cyber-risks. Thus, the correlated nature of cyber-risks negatively affects the efficiency and effectiveness of cyber-insurance products. The overall problem of inefficiency and ineffectiveness can be better understood in the light of following problems in the cyber-insurance products. 2. **Information Asymmetry:** Cyber-insurance markets are inefficient and incur additional costs due to information asymmetry. The cyber-insurance products are often customized to address the specific requirements of the client, however, if the cyber-insurance buyer does not know all about the product coverage, then there is an information asymmetry between the client and the provider. This can be explained with the theory of \"The Market for Lemons\" proposed by George A. Akerlof [66]. Akerlof introduced \"The Market for Lemons\" with the question of why there is a \"large price difference between new cars and those which have just left the showroom\" [66]. It suggests that cyber-insurance products are a trust good, and all the coverage details are not visible to the buyer. As a buyer cannot differentiate between a \"good\" coverage and \"less\" coverage products, the product is traded at the price of \"less\" coverage products (and high risk) (lemons). The famous case of Sony and Zurich Insurance is a relevant example [67]. In addition to the problem of lemons market, the cyber-insurance domain suffers from the problem of \"adverse selection\". An adverse selection arises when the client has some relevant information and the information is not disclosed to the cyber-insurance provider, _i.e._, the client knows about the risk for which it wants to acquire a cyber-insurance policy. The adverse selection can be explained with the theory of \"The Market for Insurance\" [68]. The third type of information asymmetry in the cyber-insurance field is \"moral hazard\". A moral hazard arises when the buyer is purchasing a coverage based on the experience of losses. Thus, the buyer of the insurance product may have no or less incentive in mitigating the risk, instead the buyer prefers to transfer the risk to the insurer. 3. **Incomplete Markets:** Cyber-insurance products available in the market are very limited in terms of variety of risks and their coverage [69; 70]. In other words, the cyber-insurance markets do not provide an opportunity to hedge \"all\" (wide variety) of risks for which hedging mechanisms are required. In such a scenario, information security stakeholders have to bear the risk, or they use the less optimal mechanisms to transfer/hedge the risks [69]. This discrepancy in risk exposure and actual risk coverage is usually termed as \"Basis Risk\". 4. **Lack of Liquidity:** It is crucial to have liquid markets to achieve effective risk hedging. However, once a cyber-insurance policy is purchased, the client has no mechanism during the contract period to adjust (buy or sell) his position according to the latest risk scenario. 5. **High Transaction Cost:** Currently, transaction costs are high in cyber-insurance and reinsurance markets. Typically, the risk is transferred through contracts, credit risk of counterparties is evaluated, and risk management systems are deployed and maintained. However, due to the interdependent and correlated nature of information security risks, the capitalization levels to support the insurance liabilities may be dramatically out of equilibrium [69; 70; 71]. 6. **Regulatory Capital Requirements:** Regulatory requirements, such as Solvency-II [72] require (re-)insurers to meet the capital requirements. These capital requirements and requirements to maintain a risk management system increases the cost of capital. Also, this creates barriers to entry for new entrants into the cyber-(re)insurance market. 7.