# Cyber Loss Distribution Fitting: A General Framework towards Cyber Bonds and Their Pricing Models

Authors: Oleg Kolesnikov; Alexander Markov; Daulet Smagulov; Sergejs Solovjovs
Journal: International Journal of Mathematics and Mathematical Sciences
 (2022)

---

## Abstract

Motivated by the considerable amount of losses in (finance) industry caused every year by the fast growing number of malicious cyber events and the need of an insurance against such cyber losses, we propose a general framework of cyber bond, whose main purpose is to insure (compensate) losses of a cyber attack. Based on a database of publicly available cyber events, we determine cyber loss distribution parameters and use them to numerically simulate cyber bond price, yield, and other characteristics. We also study two approaches to cyber bond coupon calculation.


---

## Body

## 1. Introduction

Cybersecurity risk is an operational risk to information and technology assets that has consequences affecting the confidentiality, availability, or integrity of information or information systems [1]. The problem of cyber risk is highly relevant today, as hacking techniques advance rapidly (see, e.g., [2]). New ways of bypassing security and new methods of finding vulnerabilities emerge every year. The number of cyber incidents grows by 25% and the number of companies falling victim increases by 22% annually [3]. The outcomes of such incidents are reputational damage and/or material loss. More detail on the modern cyber attack techniques and their consequences can be found in, e.g., [4–7]. We emphasize that a technical discussion of these cyber attacks is off the scope of the present paper due to the lack of competence of the authors in this topic.With the evolution of hacking methods, cybersecurity techniques are improving constantly. These techniques are aimed at preventing cyber incidents and safeguarding companies against potential threats. The problem, however, is that cyberattacks are very abrupt and modeling and predicting this type of risk is complicated. Since the dynamics of cyberattacks are random and varied, full protection against cyber risk cannot be guaranteed due to the impossibility of predicting the methods and goals of an attack and the constant evolution of cyber risk [8]. Besides, there is the so-called zero-day problem when some new hacking technique emerges and no methods of defending against it are available. Also, there is no single universal method of assessing organization cyber security. There are certain models (FAIR, IRAM, CyberVaR), Global Cybersecurity Index (GCI), and ISO 27000, but no general standards and ratings have been developed. Deficiencies in cyber security techniques, lack of observation data, and complexity of loss assessment are also the factors that inhibit the development of cyber risk defense products.Since managing cyber risk is complicated, a new problem that needs to be solved emerges. Based in post-defense, the problem is to soften the effect of cyber incidents and try to benefit from them. One of the possible ways to handle the conditions of the problem is to create a model of risk bonds for a corresponding event.Event risk bonds are widely used today. An example of such securities make weather derivatives (see, e.g., [9–13]). This type of financial instruments can be used by organizations or individuals to prevent risk associated with adverse or unexpected weather conditions as stipulated in the contract. This security is an index-based instrument and uses weather observation data to create an index that a payout can be based on. Another type of such securities are catastrophe bonds, or cat bonds (see, e.g., [14–17]). This type of financial instruments helps insurance companies when a major catastrophe occurs. Such incidents may incur a huge amount of loss since the affected damage cannot be covered by investments [18]. Organizations release the above-mentioned cat bonds and pay a coupon to the investor if no catastrophe occurred. Otherwise, an insurance company can stop coupon payments and, in some cases, take out the principal and use the obtained resources to pay their claim holders.Event risk bonds are usually risky. However, they have higher coupons. In case of an event stipulated in the corresponding contract, the trigger is turned on. Depending on the amount of loss and the conditions of the contract, the company can stop coupon payment and take out the contract notional, allowing the company to offset the potential losses caused by the corresponding event.Motivated by the considerable amount of losses in (finance) industry caused every year by the above-mentioned fast growing number of malicious cyber events and thus the urgent need of some insurance against these cyber losses, we propose a general framework of cyber bond, whose main purpose is to insure (compensate) losses of a cyber attack. More precisely, in this paper, we explore the issue of cyber post-defense and suggest a new type of financial instruments where cyber incidents are the triggering events. Some organizations and banks already use such securities widely as operational risk bonds that include cyber risk into their scope. Investors though are interested in having a broad selection of securities: one wants more gain, another wants less risk. By restricting the scope of security risk factors to cyber risk only, we allow investors to get a less risky financial instrument, even though less profitable. In view of the rapid evolution of cyber risk, we expect that this type of contract will be highly demanded as a security. Stated differently, we strongly believe that our proposed cyber bonds could take a similar niche with respect to the insurance of cyber losses as the above-mentioned catastrophe or cat bonds took with respect to the insurance of catastrophe losses.This paper is structured as follows. Section2 presents our proposed general methodology of cyber bonds (e.g., their pricing) and provides a short cyber bond example. Section 3 considers cyber loss distribution fitting. More precisely, given a publicly available cyber event database, Section 3 provides the respective cyber loss frequency (interval length in days to the next loss) and cyber loss severity (actual loss amount) distributions and their parameters. The former appears to be exponential and the latter–log-normal. Finally, Section 4 provides an extensive example of a cyber bond and estimates its basic characteristics like, e.g., price, yield, etc. These characteristics appear to depend significantly on bond coupon and notional triggers, which determine whether bond coupons and notional are paid to the bondholder. Section 4 also considers two approaches to calculating bond coupons, based in probability of loss and bond par yield. It also studies the distributions of two specific event groups (cyber-related data breach and cyber-related fraud) and finds out that even though the loss severity for both groups follows the general cyber loss severity distribution (the log-normal one), the respective loss frequency is different, since it follows the non-central Fisher distribution instead of the exponential one.The authors would also like to observe that a preprint of the paper has already appeared on “arXiv” [19], which is freely available to the general public.


## 2. Methodology of Cyber Risk Bonds

### 2.1. Preconditions and Concept

The general concept of event risk securities includes some trigger that stops coupon payments partially or completely. A trigger takes some factor into account and turns on when the factor surpasses a given threshold. For example, [20] describes the following basic trigger types:(i)
with an indemnity trigger, coupon payments are stopped and/or the principal (or its part) is recovered in case one or several base events have their loss amount exceeding the threshold;(ii)
with a modeled loss trigger, coupon payments are stopped in case one or several base events have their estimated loss amount exceeding some given threshold; besides, the estimation can be performed constantly, while the actual losses are determined sometime after the incident;(iii)
with triggers indexed to industry loss, coupon payments are stopped if the total amount of insurance industry losses reaches the given threshold, which is predefined by some competent authority;(iv)
a parametric trigger is related to an actual danger and turns on if the critical level of certain conditions is reached, e.g., wind speed or area of a forest fire;(v)
a hybrid trigger combines the features of several of the triggers above.Operating principle of a trigger is illustrated in Figure1. Not all of the trigger types above meet the requirements to be used with cyber risk securities. Today, estimation of loss immediately after a cyberattack is impossible. A certain amount of time is required to determine the damage after the incident. It follows then that indemnity and industry loss triggers cannot be used for our securities. Next, due to the unpredictability of cyberattacks, we have no parameters that can signify that a cyber incident is imminent or the probability of its occurrence increases. This makes the parametric trigger inappropriate for the current problem as well.Figure 1
Trigger switches on if the basis exceeds the given threshold.However, possible losses from a cyber incident can be modeled using, e.g., Monte Carlo simulation. Thus, the modeled loss trigger can be chosen for the model. Besides, the calculated threshold of expected losses should be specified in the contract.Similarly to cat bonds, the structure of financial cyber risk instruments can be represented as follows. An issuer produces securities and takes the principal from an investor. According to the terms of the contract, the issuer then pays coupons to the investor with a given frequency unless the trigger is turned on. Also, the terms of the contract specify whether the principal should be forgiven. If the trigger is not activated for the whole time until the contract maturity, the investor takes all the coupons and the principal. The main problem is the calculation of a cyber risk contract price. The following chapter is dedicated to dealing with this problem.


### 2.2. Pricing Model

The classical approach to insurance securities pricing is to consider two distributions: distribution of events themselves and distribution of the periods between them. Throughout the paper, we will follow the same scheme generally, but certain specific features of cyber bonds in terms of pricing will be discussed.In order to construct a procedure of pricing a contract, we have to.(i)
define the set of significant risk factors;(ii)
develop a model of the risk factors changing in time;(iii)
choose a pricing policy (fair value including risk premium, prudent valuation, etc.) and price valuation approach (analysis, Monte Carlo, or PDE solution).We are going to consider the standard approach to pricing of event-linked securities, namely, fair value plus some risk premium.The risk factor modeling used in the process of pricing is based in the following assumptions. The moments when cyber incidents of typek occur can be described using time intervals between the incidents, where each of the intervals follows the same probability distribution(1)Pτk,r⩽y=Fky,in which τk,r is the interval of time between incidents r and r+1 of type k. Moreover, losses induced by cyber incident r can be described by the probability distribution law(2)Pξk,r⩽x=Gkx.DistributionsFky and Gkx are assumed to be parametric, i.e.,(3)Fky=Fky;θ,Gkx=Gkx;λ,and model risk is limited to the uncertainty of values of parameter vectors θ and λ. This uncertainty is covered by confidence intervals(4)θ∈θl;θu,λ∈λl;λu.The price of the contract is defined as the value of the fair price that is the best (maximum) in terms of parameters, where fair price is calculated analytically for linear contracts and using a Monte Carlo method for the nonlinear ones:(5)Price=maxθ∈θl;θu,λ∈λl;λuFairPriceFk⋅=Fk⋅;θ;Gk⋅=Gk⋅;λ.We would like to emphasize that there currently exist other approaches to cyber bonds as in, e.g., [21]. Generally, the underlying machinery of cyber bond pricing stems from the already well-developed technique of pricing the above-mentioned cat bonds. One can find a plentitude of cat bond pricing methodologies in the literature as in, e.g., [22]. In particular, the paper in question considers two distributions: the distribution of loss frequency, i.e., how often do catastrophic events occur (an analogue of Fky in our case) and the distribution of loss severity, i.e., how much money do catastrophic events require to cover the incurred losses (an analogue of Gkx in our case). The authors find the appropriate distribution laws (e.g., Poisson law for the loss frequency distribution and, e.g., log-normal law for the loss severity distribution) as well as estimate the corresponding distribution parameters. The respective pricing model then depends on the obtained distribution laws and their estimated parameters relying, moreover, on a risk-neutral probability measure. We roughly follow the same path, where FairPrice in our formula (5) is taken to be the standard coupon-bearing bond pricing formula (6) of Subsection 4.1 of the present paper stemming from, e.g., [23], [Subsection 14.7.2] (i.e., the sum of the discounted bond principal and the coupons). What is the role of Fkx and Gkx then?. They determine, whether the number and/or total loss of cyber events is such that one should stop coupon payment and/or forget the payment of the bond principal (decreasing thus the number of summands in the bond pricing formula). More detail on our bond pricing technique can be found in Subsection 4.1.


### 2.3. Numerical Results

For the purposes of our study, a Monte Carlo simulation of events and periods between them was carried out. Based in the distributions fitted below, the average price of a bond over a number of simulations was estimated. In addition, Greeks and coupon payment probabilities were calculated.Our cyber risk security pricing model supports the following risk factors:(i)
change of a risk-free rate (risk factor to be taken into account while discounting and valuating the coupons in case it is linked to, e.g., LIBOR or SOFR);(ii)
the moment when a cyber incident happened;(iii)
aggregated financial losses (optional, can be considered as a single risk factor or a sum of separate risk factors by the source of loss: client payments, business process interruption, reputational loss, etc.);(iv)
risk of the “incorrect” valuation of the risk factors above (model risk, which is significant in case the securities are linked to cyber incidents (insurance or security) due to unavoidable difficulties in modeling).Dependence of the bond value on a risk-free rate and distribution parameters (located on the bounds of confidence intervals) can be assessed using the values of the corresponding Greeks shown in Table1.Table 1
Values of Greeks for99% confidence intervals bounds.
BounddS/dλdS/dμdS/dσdS/drLower−1.464−10.444−3.422Middle−2.723−11.484−6.295−2.62Upper−3.775−27.568−24.438Presented values are computed using the values of parameters given in Table2.Table 2
Other parameters used for Greeks calculation.
ParameterValueNumber of MC iterations5000Trigger for coupons$5 billionTrigger for face value$50 billionRisk-free rate2.65%Coupon30, every 182 daysFace value1000Maturity5 yearsDependence of the resulting prices on maturity and trigger values is presented in the following figures.Figures2–4 show strong dependence of cyber bond price on triggers and maturity, since all the risk can be described by these parameters.Figure 2
Cyber bond price vs. coupon trigger.Figure 3
Cyber bond price vs. face value trigger.Figure 4
Cyber bond price vs. maturity.Using parameters from Table2, one can plot the probability of coupon payment, which is depicted in Figure 5.Figure 5
Probability of coupon payment.Payment probabilities shown in Figure5 display a low survival rate, though it strongly depends on a coupon trigger value.


## 2.1. Preconditions and Concept

The general concept of event risk securities includes some trigger that stops coupon payments partially or completely. A trigger takes some factor into account and turns on when the factor surpasses a given threshold. For example, [20] describes the following basic trigger types:(i)
with an indemnity trigger, coupon payments are stopped and/or the principal (or its part) is recovered in case one or several base events have their loss amount exceeding the threshold;(ii)
with a modeled loss trigger, coupon payments are stopped in case one or several base events have their estimated loss amount exceeding some given threshold; besides, the estimation can be performed constantly, while the actual losses are determined sometime after the incident;(iii)
with triggers indexed to industry loss, coupon payments are stopped if the total amount of insurance industry losses reaches the given threshold, which is predefined by some competent authority;(iv)
a parametric trigger is related to an actual danger and turns on if the critical level of certain conditions is reached, e.g., wind speed or area of a forest fire;(v)
a hybrid trigger combines the features of several of the triggers above.Operating principle of a trigger is illustrated in Figure1. Not all of the trigger types above meet the requirements to be used with cyber risk securities. Today, estimation of loss immediately after a cyberattack is impossible. A certain amount of time is required to determine the damage after the incident. It follows then that indemnity and industry loss triggers cannot be used for our securities. Next, due to the unpredictability of cyberattacks, we have no parameters that can signify that a cyber incident is imminent or the probability of its occurrence increases. This makes the parametric trigger inappropriate for the current problem as well.Figure 1
Trigger switches on if the basis exceeds the given threshold.However, possible losses from a cyber incident can be modeled using, e.g., Monte Carlo simulation. Thus, the modeled loss trigger can be chosen for the model. Besides, the calculated threshold of expected losses should be specified in the contract.Similarly to cat bonds, the structure of financial cyber risk instruments can be represented as follows. An issuer produces securities and takes the principal from an investor. According to the terms of the contract, the issuer then pays coupons to the investor with a given frequency unless the trigger is turned on. Also, the terms of the contract specify whether the principal should be forgiven. If the trigger is not activated for the whole time until the contract maturity, the investor takes all the coupons and the principal. The main problem is the calculation of a cyber risk contract price. The following chapter is dedicated to dealing with this problem.


## 2.2. Pricing Model

The classical approach to insurance securities pricing is to consider two distributions: distribution of events themselves and distribution of the periods between them. Throughout the paper, we will follow the same scheme generally, but certain specific features of cyber bonds in terms of pricing will be discussed.In order to construct a procedure of pricing a contract, we have to.(i)
define the set of significant risk factors;(ii)
develop a model of the risk factors changing in time;(iii)
choose a pricing policy (fair value including risk premium, prudent valuation, etc.) and price valuation approach (analysis, Monte Carlo, or PDE solution).We are going to consider the standard approach to pricing of event-linked securities, namely, fair value plus some risk premium.The risk factor modeling used in the process of pricing is based in the following assumptions. The moments when cyber incidents of typek occur can be described using time intervals between the incidents, where each of the intervals follows the same probability distribution(1)Pτk,r⩽y=Fky,in which τk,r is the interval of time between incidents r and r+1 of type k. Moreover, losses induced by cyber incident r can be described by the probability distribution law(2)Pξk,r⩽x=Gkx.DistributionsFky and Gkx are assumed to be parametric, i.e.,(3)Fky=Fky;θ,Gkx=Gkx;λ,and model risk is limited to the uncertainty of values of parameter vectors θ and λ. This uncertainty is covered by confidence intervals(4)θ∈θl;θu,λ∈λl;λu.The price of the contract is defined as the value of the fair price that is the best (maximum) in terms of parameters, where fair price is calculated analytically for linear contracts and using a Monte Carlo method for the nonlinear ones:(5)Price=maxθ∈θl;θu,λ∈λl;λuFairPriceFk⋅=Fk⋅;θ;Gk⋅=Gk⋅;λ.We would like to emphasize that there currently exist other approaches to cyber bonds as in, e.g., [21]. Generally, the underlying machinery of cyber bond pricing stems from the already well-developed technique of pricing the above-mentioned cat bonds. One can find a plentitude of cat bond pricing methodologies in the literature as in, e.g., [22]. In particular, the paper in question considers two distributions: the distribution of loss frequency, i.e., how often do catastrophic events occur (an analogue of Fky in our case) and the distribution of loss severity, i.e., how much money do catastrophic events require to cover the incurred losses (an analogue of Gkx in our case). The authors find the appropriate distribution laws (e.g., Poisson law for the loss frequency distribution and, e.g., log-normal law for the loss severity distribution) as well as estimate the corresponding distribution parameters. The respective pricing model then depends on the obtained distribution laws and their estimated parameters relying, moreover, on a risk-neutral probability measure. We roughly follow the same path, where FairPrice in our formula (5) is taken to be the standard coupon-bearing bond pricing formula (6) of Subsection 4.1 of the present paper stemming from, e.g., [23], [Subsection 14.7.2] (i.e., the sum of the discounted bond principal and the coupons). What is the role of Fkx and Gkx then?. They determine, whether the number and/or total loss of cyber events is such that one should stop coupon payment and/or forget the payment of the bond principal (decreasing thus the number of summands in the bond pricing formula). More detail on our bond pricing technique can be found in Subsection 4.1.


## 2.3. Numerical Results

For the purposes of our study, a Monte Carlo simulation of events and periods between them was carried out. Based in the distributions fitted below, the average price of a bond over a number of simulations was estimated. In addition, Greeks and coupon payment probabilities were calculated.Our cyber risk security pricing model supports the following risk factors:(i)
change of a risk-free rate (risk factor to be taken into account while discounting and valuating the coupons in case it is linked to, e.g., LIBOR or SOFR);(ii)
the moment when a cyber incident happened;(iii)
aggregated financial losses (optional, can be considered as a single risk factor or a sum of separate risk factors by the source of loss: client payments, business process interruption, reputational loss, etc.);(iv)
risk of the “incorrect” valuation of the risk factors above (model risk, which is significant in case the securities are linked to cyber incidents (insurance or security) due to unavoidable difficulties in modeling).Dependence of the bond value on a risk-free rate and distribution parameters (located on the bounds of confidence intervals) can be assessed using the values of the corresponding Greeks shown in Table1.Table 1
Values of Greeks for99% confidence intervals bounds.
BounddS/dλdS/dμdS/dσdS/drLower−1.464−10.444−3.422Middle−2.723−11.484−6.295−2.62Upper−3.775−27.568−24.438Presented values are computed using the values of parameters given in Table2.Table 2
Other parameters used for Greeks calculation.
ParameterValueNumber of MC iterations5000Trigger for coupons$5 billionTrigger for face value$50 billionRisk-free rate2.65%Coupon30, every 182 daysFace value1000Maturity5 yearsDependence of the resulting prices on maturity and trigger values is presented in the following figures.Figures2–4 show strong dependence of cyber bond price on triggers and maturity, since all the risk can be described by these parameters.Figure 2
Cyber bond price vs. coupon trigger.Figure 3
Cyber bond price vs. face value trigger.Figure 4
Cyber bond price vs. maturity.Using parameters from Table2, one can plot the probability of coupon payment, which is depicted in Figure 5.Figure 5
Probability of coupon payment.Payment probabilities shown in Figure5 display a low survival rate, though it strongly depends on a coupon trigger value.


## 3. Example of Distribution Fitting

### 3.1. Historical Data

According to the previous section, a cyber risk security price depends on the intervals of time between the incidents and the resulting material losses. In this section, we need to estimate the families of distributionsFky|θ and Gkx|λ and their parameters θ and λ, respectively. For this example of estimation, the historical data was downloaded from [3]. This data contains information about the cyberattacks and cyber incidents that happened within the period of 2017–2018. Histograms of the data are shown in Figure 6.Figure 6
Input data histograms: time intervals between attacks (a) and losses (b).
(a)(b)


### 3.2. Estimation and Testing

From the histograms of Figure6, we conclude that for the data of time series of both intervals and losses, we need to fit the distribution defined on a semi-infinite interval. It was also considered that the distribution of time intervals should be defined in the zero value. Thus, Weibull, gamma, χ2, Fisher, and exponential distributions were selected for fitting.The maximum-likelihood estimation procedure is performed to fit the distribution. The parameters are estimated using the Nelder–Mead method. The results and the corresponding standard error values are presented in Table3.Table 3
Parameter estimates, standard error, and test results of time interval distribution fitting.
DistributionParametersStandard errorStatisticω2P valueWeibullλ=0.334, k=4.07σλ=0.03, σk=1.1663.94<0.01Gammak=0.233, θ=27.403σk=0.024, σθ=6.0929.58<0.01χ2k=1.02σk=0.08718.04<0.01Fisherd1=0.392, d2=1.334σd1=0.044, σd2=0.29811.7<0.01Exponentialλ=0.156σλ=0.0150.230.22Then, goodness-of-fit testing should be performed for each of the chosen distribution parameters. For this purpose, the Cramér–von Mises test is used [24]. We set the confidence level for the testing to 0.05. According to the results (Table 3), the exponential distribution fits our data better than the others. All tested probability distribution functions are represented in Figure 7.Figure 7
Probability distribution functions selected for time interval fitting.Since we assume that cyber incidents always cause some non-zero material losses, we need to take a distribution that is not defined in the zero value. Also, the corresponding histogram shows that the data has heavy tails (the value close to $3 billion). The log-normal distribution meets all the requirements. In particular, [8] shows that the log-normal distribution fits losses data the best. The estimated parameters and goodness-of-fit test results are shown in Table 4. The test results show that this distribution satisfies the corresponding time series of losses. The results of fitting are shown in Figure 8. Note that the data is shown in a logarithmic scale, thus the log-normal probability distribution function visually looks like the normal distribution function.Table 4
Parameter estimates and standard error for distributions of loss data.
DistributionParametersStandard errorStatisticω2P valueLog-normalμ=13.639, σ=2.832σμ=0.268, σσ=0.1890.0380.94Figure 8
Probability distribution functions selected for loss fitting (logarithmic scale).


### 3.3. Confidence Interval for Estimated Parameters

Following the idea of prudent valuation methodology [25], we need to calculate the confidence interval for the estimated parameters. The lower and upper bounds for the parameters were calculated at the 80%, 97%, 99%, and 99.9% confidence levels. The values are shown in Table 5.Table 5
Confidence interval for estimates.
DistributionParameterStd. errorBound80%97%99%99.9%Exponential (time intervals)λ=0.156σλ=0.015Lower0.1370.1240.1180.107Upper0.1750.1880.1940.205Log-normal (losses)μ=13.639σμ=0.268Lower13.29613.05812.95012.758Upper13.98214.22014.32814.519σ=2.832σσ=0.189Lower2.5892.4212.3442.209Upper3.0743.2433.3193.455


## 3.1. Historical Data

According to the previous section, a cyber risk security price depends on the intervals of time between the incidents and the resulting material losses. In this section, we need to estimate the families of distributionsFky|θ and Gkx|λ and their parameters θ and λ, respectively. For this example of estimation, the historical data was downloaded from [3]. This data contains information about the cyberattacks and cyber incidents that happened within the period of 2017–2018. Histograms of the data are shown in Figure 6.Figure 6
Input data histograms: time intervals between attacks (a) and losses (b).
(a)(b)


## 3.2. Estimation and Testing

From the histograms of Figure6, we conclude that for the data of time series of both intervals and losses, we need to fit the distribution defined on a semi-infinite interval. It was also considered that the distribution of time intervals should be defined in the zero value. Thus, Weibull, gamma, χ2, Fisher, and exponential distributions were selected for fitting.The maximum-likelihood estimation procedure is performed to fit the distribution. The parameters are estimated using the Nelder–Mead method. The results and the corresponding standard error values are presented in Table3.Table 3
Parameter estimates, standard error, and test results of time interval distribution fitting.
DistributionParametersStandard errorStatisticω2P valueWeibullλ=0.334, k=4.07σλ=0.03, σk=1.1663.94<0.01Gammak=0.233, θ=27.403σk=0.024, σθ=6.0929.58<0.01χ2k=1.02σk=0.08718.04<0.01Fisherd1=0.392, d2=1.334σd1=0.044, σd2=0.29811.7<0.01Exponentialλ=0.156σλ=0.0150.230.22Then, goodness-of-fit testing should be performed for each of the chosen distribution parameters. For this purpose, the Cramér–von Mises test is used [24]. We set the confidence level for the testing to 0.05. According to the results (Table 3), the exponential distribution fits our data better than the others. All tested probability distribution functions are represented in Figure 7.Figure 7
Probability distribution functions selected for time interval fitting.Since we assume that cyber incidents always cause some non-zero material losses, we need to take a distribution that is not defined in the zero value. Also, the corresponding histogram shows that the data has heavy tails (the value close to $3 billion). The log-normal distribution meets all the requirements. In particular, [8] shows that the log-normal distribution fits losses data the best. The estimated parameters and goodness-of-fit test results are shown in Table 4. The test results show that this distribution satisfies the corresponding time series of losses. The results of fitting are shown in Figure 8. Note that the data is shown in a logarithmic scale, thus the log-normal probability distribution function visually looks like the normal distribution function.Table 4
Parameter estimates and standard error for distributions of loss data.
DistributionParametersStandard errorStatisticω2P valueLog-normalμ=13.639, σ=2.832σμ=0.268, σσ=0.1890.0380.94Figure 8
Probability distribution functions selected for loss fitting (logarithmic scale).


## 3.3. Confidence Interval for Estimated Parameters

Following the idea of prudent valuation methodology [25], we need to calculate the confidence interval for the estimated parameters. The lower and upper bounds for the parameters were calculated at the 80%, 97%, 99%, and 99.9% confidence levels. The values are shown in Table 5.Table 5
Confidence interval for estimates.
DistributionParameterStd. errorBound80%97%99%99.9%Exponential (time intervals)λ=0.156σλ=0.015Lower0.1370.1240.1180.107Upper0.1750.1880.1940.205Log-normal (losses)μ=13.639σμ=0.268Lower13.29613.05812.95012.758Upper13.98214.22014.32814.519σ=2.832σσ=0.189Lower2.5892.4212.3442.209Upper3.0743.2433.3193.455


## 4. Cyber Bond Example

### 4.1. General Example Setting

In this section, we consider an example of cyber bonds related to a concrete (and randomly chosen) cyber event. As follows from, e.g., [26] in February 2019, a Maltese bank (namely, Bank of Valletta) suffered a cyber attack which saw EUR13 million transferred out of the bank through false international transactions. In the wake of the above event, we assume that the bank wants to insure itself against such cyber attacks in the future. It recognizes though that concentrating on information technology security alone (even though it is an essential protection component) could not always be enough since cyber attacks are getting more sophisticated with time. Thus, as a possible additional preventive, one could issue cyber bonds to cover losses in the case of a successful cyber attack against the bank. We consider an example of such a cyber bond.Motivated by the above-mentioned cyber attack loss, we will assume that the bond notional is set to $ 15 million (rounding the result of EUR/$ exchange). US dollars are chosen over euros for the specific Federal Reserve (FRED) databases used in the below bond-related calculations. The bond maturity will be chosen as 3 years (this reflects a time-changing cyber security risk as well as trims large numbers obtained for longer maturities). We assume that the bond pays a coupon every half a year. There could be up to 6 coupons (we will explain “could” in a moment) during the life of the bond. From the several possible cyber bond coupon calculation techniques, two of which are considered in Section4.4, we choose the par yield approach (described in Section 4.4.2) and set bond coupon percentage to 5.09%, which amounts to 764,055.87. The funding rate for discounting during bond valuation is set to a 3-year Intercontinental Exchange (ICE) swap rate based on USD (taken from [27]) which equals 1.52% (as of August 15, 2019). The above characteristics of the cyber bond are summarized in Table 6.Table 6
Cyber bond parameters.
Bond parameterValueNotional15 millionMaturity3 yearsCoupon rate5.09%Coupon value764,055.87Funding rate1.52%We use the standard formula for bond priceP:(6)P=∑i=16C⋅e−R⋅di/365+N⋅e−R⋅d/365,where C is a coupon value, R is a funding rate, di (resp. d) is the date of the coupon payment (resp. Notional payment) in days, and N is the notional value. In our case, coupon payments are on days 182, 365, 547, 730, 912, and 1095. The last date also corresponds to the payment of the notional.With formula (6) in mind, our cyber bond is assumed to be priced as follows. In the first step, one simulates cyber losses for the bond maturity period, i.e., 3 years. This simulation includes a day of the loss and its size (cyber loss distribution parameters will be discussed in a moment). In the second step, one uses two triggers, namely, notional and coupon trigger, to determine whether coupons and notional will be paid. More precisely, for every coupon (resp. notional) one sums up the simulated losses up to the respective payment day. If the losses are strictly less than the trigger, then the respective payment is made; otherwise not. This explains our “could” used to describe the number of coupons of our proposed cyber bond. These triggers are aimed to reflect the state of the industry with respect to cyber attacks. Coupon trigger is assumed to be less than the notional trigger and should define the first level of danger (payment of all or part of the coupons is therefore dropped). Notional trigger represents the second (and highest) level of danger when measures should be taken to compensate losses (payment of the notional is thus dropped). It should be noted, however, that the triggers of other nature are also possible. For example, one could possibly watch for the appearance of a certain number of events with certain losses. One could also watch for the events of a certain nature (e.g. current ransomware attacks) or a certain sequence of cyber events reflecting some pattern. These triggers will not be considered in this paper since they require a deeper and case-specific analysis of an available and comprehensive cyber event database.


### 4.2. Cyber Loss Distribution Parameters

A word is due to the distribution of cyber losses used in this section. Following the results of Section3, we assume that cyber losses are characterized by two parameters, namely, the interval in days to the next loss and actual loss amount. Interval value is assumed to be distributed exponentially, whereas actual loss value is assumed to have a log-normal distribution. The respective parameters together with the standard errors are given in Table 7.Table 7
Cyber loss distribution parameters.
DistributionParametersStd. errorExponential (number of days till the next loss)λ=0.02110.0029Log-normal (actual loss amount)μ=14.91790.2009σ=2.34340.1421We emphasize that the arrival times of the cyber events are modeled using the exponential distribution. This is similar to the distribution, which underlies models of traded credit instruments such as, e.g., credit default swaps (CDS) (see, e.g., [28]).The parameters of Table7 were calculated from our obtained table of publicly available cyber events. This table contains 328 items, with 136 of them having publicly disclosed loss amount. These events are ranging from the years 2009–2019. The motivating event for our considered cyber bond is taken from this table. The distribution parameters themselves were obtained through the maximum-likelihood method using Nelder–Mead and Broyden–Fletcher–Goldfarb–Shanno optimization algorithms for one- and two-parameter distributions, respectively. Moreover, to estimate the exponential distribution parameter λ, we made the next two preparatory steps with the available data:(S1) The series of cyber event dates was modified to contain unique items only.(S2) The series of interval lengths between two consecutive cyber events was modified to contain unique items only.Table8 shows the results of the goodness-of-fit (GOF) tests performed by us to justify the choice of cyber loss distribution and the respective distribution parameters (notice that the null hypothesis in each of the tests says that the true distribution is the one mentioned in the first column of Table 8 with the respective parameters taken from the second column of Table 8; to reject the null hypothesis with significance level of 5%, one searches a value less than 0.05 in the last column of Table 8).Table 8
Cyber loss distribution GOF tests.
DistributionParametersGOF testTest statisticP valueExponentialλ=0.0211Chi-square4.16980.8415λ=0.0211Kolmogorov–Smirnov0.11380.4642Log-normalμ=14.9179Chi-square7.38240.8313σ=2.3434μ=14.9179Kolmogorov–Smirnov0.0570.7687σ=2.3434Additionally, Figures9 and 10 show the histograms of time interval (in days) to the next loss and actual loss amount, both with their assumed distributions.Figure 9
Histogram of time interval (in days) to the next loss and its assumed distribution.Figure 10
Histogram of actual loss amount and its assumed distribution.Backed by the results of Table8 (no rejected null hypothesis) and the visual inspection of Figures 9 and 10 (the proposed distributions are “reasonably” close to the histograms), we will rely on the cyber loss distributions and the parameters of Table 7 in the rest of the paper.Finally, we do not claim to use the all-including table of losses since many cyber events are not publicly disclosed. We do believe, however, that this table is comprehensive enough to provide numerical estimations for our considered example of cyber bonds. Moreover, similar to [29], we do believe that there already exist enough available cyber event data for the successful treatment of cyber bonds.


#### 4.2.1. Distribution of Cyber Losses of Specific Type

This section answers the question on whether all cyber event types in the used database follow the same distribution. More precisely, we single out two particular cyber event groups (namely, the two biggest ones in our database) and try to find their respective loss frequency (interval length in days to the next loss) and loss severity (actual loss amount) distributions. We will follow the distribution fitting steps of Section3.(1) Cyber-Related Data Breaches. The first group contains cyber-related data breaches. We notice that this type of cyber events is extremely important for financial institutions often storing sensitive client data, which in their turn could be a lucrative target for cyber criminals. There are altogether 70 such events in our available database, with 12 of them having publicly disclosed loss amount.We first concentrate on loss frequency distribution and its parameters. Table9 shows possible loss frequency distributions of cyber-related data breach and their respective parameters with the standard errors (the reader may recall that we follow the fitting steps of Section 3 and, thus, the distributions).Table 9
Cyber-related data breach loss frequency distribution parameters.
DistributionParametersStandard errorChi-squarek=24.4751.1423Exponentialλ=0.01510.0025Fisherd1=0.660.4092d2=2.06430.6131λ=10.38344.3761Gammaα=0.59790.1179β=0.00910.0026Weibullk=0.69120.0832λ=48.503912.4018The distribution parameters of Table9 were obtained by the maximum-likelihood method using Nelder–Mead and Broyden–Fletcher–Goldfarb–Shanno optimization algorithms. The two preparatory steps from the beginning of Section 4.2 ((S1), (S2)) were taken to adjust available cyber event occurrence data.Table10 shows our performed GOF tests for the distributions of Table 9.Table 10
Cyber-related data breach loss frequency distribution of GOF tests.
DistributionParametersGOF testTest statisticP valueChi-squarek=24.475Chi square59.50.0000k=24.475Kolmogorov–Smirnov0.34790.0002Exponentialλ=0.0151Chi square12.50.0853λ=0.0151Kolmogorov–Smirnov0.27430.0069Fisherd1=0.66Chi square1.50.9927d2=2.0643λ=10.3834d1=0.66Kolmogorov–Smirnov0.05210.9999d2=2.0643λ=10.3834Gammaα=0.5979Chi square9.50.1473β=0.0091α=0.5979Kolmogorov–Smirnov0.18520.149β=0.0091Weibullk=0.6912Chi square60.4232λ=48.5039k=0.6912Kolmogorov–Smirnov0.13850.4538λ=48.5039Based on the results of Table10, namely, its last column, where the value below 0.05 leads to distribution rejection, we assume that the most suitable loss frequency distributions of cyber-related data breach are Fisher, Gamma, and Weibull with the respective parameters. After the visual inspection of Figure 11, which displays a cyber-related data breach loss frequency histogram and its assumed distributions, we conclude that the most suitable cyber-related data breach loss frequency distribution is Fisher with d1=0.66, d2=2.0643, and λ=10.3834 (where, λ is non-centrality parameter).Figure 11
Cyber data breach loss frequency histogram and its assumed distributions.We now pay attention to the loss severity distribution and its parameters. Tables11 and 12 show cyber-related data breach loss severity distribution parameters with the standard errors and the respective GOF tests.Table 11
Cyber-related data breach loss severity distribution parameters.
DistributionParametersStandard errorLog-normalμ=15.68260.759σ=2.62920.5367Table 12
Cyber-related data breach loss severity distribution of GOF test.
DistributionParametersGOF testTest statisticP valueLog-normalμ=15.6826Chi square20.5724σ=2.6292μ=15.6826Kolmogorov–Smirnov0.14160.9424σ=2.6292Based on the results of Table12, namely, its last column, we assume that the log-normal distribution with the parameters μ=15.6826 and σ=2.6292 is suitable for cyber-related data breach loss severity. This is confirmed by the visual inspection of Figure 12, which displays a cyber-related data breach loss severity histogram and its assumed distribution (notice that the number of events with publicly disclosed loss is small enough and, thus, the respective histogram has a rather awkward shape).Figure 12
Cyber data breach loss severity histogram and its assumed distribution.(2) Cyber-Related Fraud. The second group contains cyber-related fraud events, which are also an important issue for financial institutions (consider, e.g., credit card fraud or e-mail fraud; the latter is gaining in popularity more and more). There are altogether 96 such events in the available database, with 69 of them having publicly disclosed loss amount.We first study loss frequency distribution and its parameters. Table13 shows possible cyber-related fraud loss frequency distributions and their respective parameters together with the standard errors.Table 13
Cyber-related fraud loss frequency distribution parameters.
DistributionParametersStandard errorChi-squarek=21.06881.0713Exponentialλ=0.01820.0031Fisherd1=0.69830.4044d2=2.51580.8009λ=10.42614.2168Gammaα=0.61090.1226β=0.01110.0033Weibullk=0.69830.0811λ=39.49410.1437The distribution parameters of Table13 were obtained through the maximum-likelihood method with the two above-mentioned optimization algorithms. The preparatory steps of Section 4.2 ((S1), (S2)) were taken to adjust the available cyber event occurrence data.Table14 shows GOF tests for the distributions of Table 13.Table 14
Cyber-related fraud loss frequency distribution of GOF tests.
DistributionParametersGOF testTest statisticP valueChi-squarek=21.0688Chi square56.28570.0000k=21.0688Kolmogorov–Smirnov0.28390.0055Exponentialλ=0.0182Chi square11.02860.1374λ=0.0182Kolmogorov–Smirnov0.26340.0124Fisherd1=0.6983Chi square1.25710.996d2=2.5158λ=10.4261d1=0.6983Kolmogorov–Smirnov0.0481d2=2.5158λ=10.4261Gammaα=0.6109Chi square8.45710.2065β=0.0111α=0.6109Kolmogorov–Smirnov0.18460.162β=0.0111Weibullk=0.6983Chi square9.48570.148λ=39.494k=0.6983Kolmogorov–Smirnov0.12910.5602λ=39.494Based on the results of Table14, namely, its last column, where the value below 0.05 leads to distribution rejection, we assume that the most suitable cyber-related fraud loss frequency distributions are Fisher, Gamma, and Weibull. After the visual inspection of Figure 13, a displaying cyber-related data breach loss frequency histogram and its assumed distributions, we conclude that the most suitable cyber-related fraud loss frequency distribution is Fisher with d1=0.6983, d2=2.5158, and λ=10.4261 (non-centrality parameter).Figure 13
Cyber fraud loss frequency histogram and its assumed distributions.We now concentrate on the loss severity distribution and its parameters. Tables15 and 16 show cyber-related fraud loss severity distribution parameters with the standard errors and the respective GOF tests.Table 15
Cyber-related fraud loss severity distribution parameters.
DistributionParametersStandard errorLog-normalμ=14.63050.2959σ=2.45820.2093Table 16
Cyber-related fraud loss severity distribution GOF test.
DistributionParametersGOF testTest statisticP valueLog-normalμ=14.6305Chi square9.59420.2947σ=2.4582μ=14.6305Kolmogorov-smirnov0.09930.504σ=2.4582Based on the results of Table16 (namely, its last column), we assume that the log-normal distribution with the parameters μ=14.6305 and σ=2.4582 is suitable for cyber-related fraud loss severity. This is confirmed by the visual inspection of Figure 14, which displays a cyber-related fraud loss severity histogram and its assumed distribution.Figure 14
Cyber fraud loss severity histogram and its assumed distribution.In conclusion, we shall notice that even though loss severity for both the initial database and two checked event groups can be assumed to follow log-normal distribution, loss frequency distribution for the initial (exponential) database differs from that of the two considered event groups (non-central Fisher). Therefore, a particular attention to the loss frequency distribution should be paid, when working with cyber events of a specific type.


### 4.3. Cyber Bond Numerical Results

This subsection lists the obtained numerical results on our proposed cyber bond example. We rely on Monte Carlo simulations, with the simulation number always being 5,000.Figure15 represents quantiles of losses for the maturity period of the cyber bond, that is, 3 years. The quantiles are calculated from Monte Carlo simulations. As can be seen from Figure 15, using our generated loss distribution parameters, the losses can reach the level of $8 billion. We use these obtained loss amounts to test the influence of bond coupon and notional triggers on the actual bond parameters (e.g., price, yield, etc.).Figure 15
Quantiles of cyber losses for the period of 3 years.We have already mentioned that a bond coupon trigger can influence the number of paid coupons on the bond. We now calculate a bond coupon survival curve. As we mentioned before, the bond is assumed to pay a coupon every 6 months. Thus, altogether there are 6 coupons. Figure16 shows the probability of the payment of each coupon depending on the coupon trigger. Recall that a coupon is not paid as soon as the total losses up to the coupon payment date exceed a specific amount (bond coupon trigger). Coupon payment probability is calculated as follows. In the first step, Monte Carlo simulations give a series or 0 s and 1 s depending on whether the respective coupon was paid or not. In the second step, one calculates the probability of coupon payment as the number of 1 s divided by the number of simulations. As can be seen from Figure 16, the coupon trigger of 2.04 billion, which corresponds to about 90% quantile as per Figure 15, gives a “reasonable” coupon payment probability close to 1. The lines in Figure 16 correspond to 10%–90% loss quantiles with the uniform step chosen between them.Figure 16
Cyber bond coupon survival curve for 3 years.Similar to the coupon survival curve, we now show a notional survival curve for our proposed cyber bond. As mentioned before, the bond notional is paid back provided that the total loss up to the payment date does not exceed the bond notional trigger. Figure17 shows the probability of a notional payment for different notional triggers. The calculation methodology follows the one for the bond coupons. Notional triggers correspond to loss 10%–99% quantiles. Following Figures 15 and 17, losses above $ 2 billion (i.e., above 90% quantile) show a “reasonable” notional payment probability (above 90% as per Figure 17). In general, it is up to a risk-taker to decide which notional payment probability and, therefore, which notional trigger to choose for the issue of a cyber bond.Figure 17
Cyber bond notional survival curve for 3 years.In the next step, we are going to show our proposed cyber bond yield curve, which allows one to judge the profitability of the proposed bond. A bond yieldY is calculated by the following formula:(7)Y=CP⋅100%,where C is the bond coupon and P is the bond price. Figure 18 shows a cyber bond yield curve depending on both notional as well as coupon triggers. At least two things can be seen from the figure. First, a bond yield is not much influenced by a coupon trigger except for very small notional and coupon triggers. Second, starting from the notional trigger of about $2 billion (corresponding roughly to 90% quantile as per Figure 15), the bond yield stabilizes around 5% with the exception of a relatively small coupon trigger of $0.19 billion, for which the yield stays strictly above 5%, i.e., almost triples our assumed funding rate.Figure 18
Cyber bond yield curve.For the reader’s convenience, Figure19 shows our proposed cyber bond yield spread, i.e., the difference between the cyber bond yield and the funding rate used in the bond estimate (recall that the assumed funding rate amounts to 1.52%) depending on both coupon and notional triggers. As can be seen from the figure, the benefit of investing into our proposed cyber bond is about 3% (under “reasonable” assumptions on bond triggers).Figure 19
Cyber bond yield spread.Finally, we present our proposed cyber bond price curve. Figure20 shows that for “reasonable” coupon and notional triggers the bond price stabilizes somewhere around $ 17 million. We notice that the standard bond price (calculated by formula (6)), i.e., omitting both a coupon and a notional trigger, is 18,797,813.26.Figure 20
Cyber bond price curve.


### 4.4. Cyber Bond Risk Premium

This section considers several approaches to calculating our proposed cyber bond risk premium, namely, a bond coupon, to account for possible coupon (or even the notional itself) loss. It is up to the ultimate issuer of the cyber bond to choose the most suitable technique or invent a new one if necessary.


#### 4.4.1. First Alternative: Probability of Loss

As the first approach to calculating cyber bond coupons, we take the analogy of catastrophe bonds (cat bonds for short) studied in, e.g., [30], since a cyber attack could be considered as a kind of catastrophe. A general coupon calculation formula for cat bonds can be written as follows:(8)Couponrate%=LIBOR%+Riskpremium%,where the risk premium should hedge the exposure of investors (into the bonds) to catastrophe risk (notice that following the current trend (see, e.g., [31]), LIBOR rate could be replaced by an alternative reference rate (ARR)). The above-mentioned risk premium could be then determined as follows:(9)Riskpremium%=Constant%+Lossmultiplier⋅Expectedloss%,where the expected loss is a percentage of the notional expected to be lost during the bond maturity period, the constant is the rate of return requested by investors, and the loss multiplier reflects the uncertainty related to the expected loss. For example, following the results of [30], [p. 1491], which are based on catastrophe bonds issued during the years 2006–2012 and covering earthquake risks, the constant amounts to 3.35% and the multiplier amounts to 1.4817. Additionally, as follows from the results of [32], [p. 168] based on the US catastrophe bonds issued during the years 1998–2008 and covering wind risks, the constant (resp. multiplier) amounts to 3.33% (resp. 2.4).To simplify the setting, we assume that the constant (the loss multiplier, respectively) in formula (9) is equal to 0 (resp. 1) since these parameters are highly dependent on investors. Moreover, following [15], [p. 817], we assume that expected loss EL is related to probability of loss PL and percentage of notional lost PNL given the loss occurs as follows:(10)EL%=PL⋅PNL%.In our cyber bond setting, PNL always amounts to100%, since the notional is either paid back or not paid at all (cases of the partial repayment of the bond notional, despite the fact that they are possible, are not considered in this paper). Thus, in our considered case of cyber bonds, formula (8) simplifies to(11)Couponrate%=LIBOR%+PL%.Moreover, it is clear that PL of our proposed cyber bond depends on the notional trigger. The lower is the trigger, the more probable it is that the notional will not be paid back. Since this paper does not specify a specific trigger but rather considers trigger influence on bond characteristics, we calculated the average probability of not getting back notional from the notional survival curve of Figure17. Thus, we obtain 11.58% (notice that according to [30], [p. 1490], for catastrophe bonds issued during the years 1999–2012 and covering earthquake risks, mean, maximum, and minimum risk premiums are 5.63%, 14.5%, and 1.5%, respectively, with the standard deviation being 2.70%. Therefore, our obtained number is in line with, e.g., earthquake risk). The average was taken over all the loss quantiles considered in the figure (see Section 4.3 for more details). For convenience of the reader, Figure 21 shows PL for different notional triggers. As can be seen from the figure, for low notional triggers PL could exceed 80%.Figure 21
Cyber bond probability of loss for the period of 3 years.Altogether, taking into account that 6-month LIBOR on USD (taken from, e.g., [27] on August 15, 2019) is 2.05% and that our proposed cyber bond pays a coupon every 6 months, the total bond coupon resulting from the first coupon calculation technique (i.e., according to formula (11)) is 13.63%.


#### 4.4.2. Second Alternative: Par Yield

As the second approach to cyber bond coupon calculation, we consider the concept of a bond par yield. Recall from, e.g., [33], [p. 85] that a bond par yield is a coupon rate for which the bond price equals its par value, namely, the notional value. It is easy to see (taking into consideration formula (6)) that the bond coupon C for par yield can be calculated as follows (keeping in mind that N is bond notional):(12)C=N⋅1−e−R⋅d/365∑i=16e−R⋅di/365.The respective par yield PY is then derived as(13)PY=CN⋅100%=1−e−R⋅d/365∑i=16e−R⋅di/365⋅100%.The obtained par yield PY is then set to be the bond coupon rate.In the case of our proposed cyber bond, some of the coupons and even the notional itself may not be paid back to the bondholder, which depends on the actual cyber losses. Thus, we first simulate cyber losses for the bond maturity period and then calculate cyber bondPY by formula (13), where now some of e−R⋅di/365 and even e−R⋅d/365 may be taken 0 depending on whether the respective item is paid to the bondholder or not.Figure22 shows the obtained par yield curves depending on both notional and coupon triggers. Since none of the triggers (both depending on the actual bond issuer) is fixed in this paper, we calculate the final coupon percentage as the average par yield over all the obtained curves getting thus 5.09% (recall from Section 4.1 that this amounts to $764,055.87 as per assumed bond notional of $15 million).Figure 22
Cyber bond par yield curve.In order to be more aggressive in bond coupons, one could increase the parameters of Table7, namely, the loss frequency (severity) parameter λ (resp. μ). As an example, Figures 23 and 24 show par yield curves for 25% (resp. 5%) increase of λ (resp. μ) value. The resulting cyber bond par yields are then 6.52% and 10.92%, respectively. One could tune both parameters increase according to the needs of the bond issuer. It is also easy to see that the unreasonable increase of the loss severity parameter μ could badly influence a bond coupon rate (namely, in the current cyber bond setting, 5% increase of μ almost doubles the coupon rate obtained through 25% increase of λ).Figure 23
Cyber bond par yield curve for loss frequency parameterλ increase of 25%.Figure 24
Cyber bond par yield curve for loss severity parameterμ increase of 5%.Notice that increasing the cyber loss frequency or severity parameter will influence other cyber bond characteristics as well. For example, Figures25–27 show cyber bond spreads (namely, bond coupon percentage minus funding rate) for initial λ and μ as well as their increased values for 25% and 5%, respectively.Figure 25
Cyber bond spread.Figure 26
Cyber bond spread for loss frequency parameterλ increase of 25%.Figure 27
Cyber bond spread for loss severity parameterμ increase of 5%.Additionally, Figures28 and 29 show the bond notional survival curves for loss frequency λ and loss severity μ in the intervals λ±λ⋅25% and μ±μ⋅5%, respectively. It can be easily seen from Figure 29 that 5% loss severity parameter increase visibly reduces notional payment probability with the set of current possible notional triggers.Figure 28
Cyber bond notional survival curve for 3 years forλ in the interval λ±λ⋅25%.Figure 29
Cyber bond notional survival curve for 3 years forμ in the interval μ±μ⋅5%.Finally, Figures30 and 31 show the probability of (notional) loss PL for different notional triggers for loss frequency λ and loss severity μ in the intervals λ±λ⋅25% and μ±μ⋅5%, respectively. These two figures just mirror the results of Figures 28 and 29.Figure 30
Cyber bond probability of loss for 3 years forλ in the interval λ±λ⋅25%.Figure 31
Cyber bond probability of loss for 3 years forμ in the interval μ±μ⋅5%.


### 4.5. Simple Result Analysis

The numerical results of Section4.3 show that the choice of notional and in some cases, coupon trigger could significantly influence our proposed cyber bond parameters. For example, as follows from Figure 18, under the small notional and coupon triggers, the cyber bond yield could reach double-digits. Such a high bond yield, however, comes from a rather low bond price as per Figure 20. It is additionally influenced by the bond risk premium, which should be tuned to the needs of a specific investor. Under the “reasonable” notional and coupon triggers, as follows from Figure 19, the benefit of investing into our proposed cyber bond over relying on the funding rate is about 3%. Since we propose a general cyber bond framework only, it is up to the actual risk-taker to decide which notional and coupon trigger should be deemed reasonable. Moreover, other trigger types (instead of just summing up losses up to a certain date) could be explored in case it is necessary for the bond issuer as mentioned at the end of Section 4.1.The two techniques to calculate a cyber bond coupon rate considered in Section4.4 could provide an entry point for the actual calculations done by the bond issuer. The expected loss approach (taken from the setting of cat bonds) provides a higher coupon rate in comparison with the par yield approach (13.63% versus 5.09%, respectively). The latter rate, however, could be easily increased through changing the cyber loss frequency and loss severity parameters (to 6.52% and 10.92%, respectively). Changing those parameters though could lead to a significant worsening of other cyber bond characteristics, e.g., increasing the probability of the notional loss for the notional trigger.Finally, we would like to emphasize that due to lack of properly developed cyber bond framework in the literature, we are unable to make a proper comparison of our setting with some other main-stream techniques. For example, Xu and Zhang [21] rely on the setting of cat bonds to deal with the insurance of losses of a cyber-related data breach. In particular, they develop a multi-period pricing model for data breach cat bonds by combining data breach risks and financial market risks based in the equilibrium pricing theory. The main advantage of our approach is two-fold: it is simple and also sufficiently general to be applied to any type of cyber-related loss. For instance, we can easily switch from cyber-related data breach to cyber-related fraud, both of which were considered in this section. Moreover, while calculating the coupons of a cyber bond, we do not only follow the classical cat bond approach but also present an alternative par yield technique, which could be more suitable for cyber bonds, since cyber events are essentially different from the classical catastrophe events (like, e.g., hurricanes) in terms of, e.g., that the actual loss caused by a cyber event is not always seen immediately.


## 4.1. General Example Setting

In this section, we consider an example of cyber bonds related to a concrete (and randomly chosen) cyber event. As follows from, e.g., [26] in February 2019, a Maltese bank (namely, Bank of Valletta) suffered a cyber attack which saw EUR13 million transferred out of the bank through false international transactions. In the wake of the above event, we assume that the bank wants to insure itself against such cyber attacks in the future. It recognizes though that concentrating on information technology security alone (even though it is an essential protection component) could not always be enough since cyber attacks are getting more sophisticated with time. Thus, as a possible additional preventive, one could issue cyber bonds to cover losses in the case of a successful cyber attack against the bank. We consider an example of such a cyber bond.Motivated by the above-mentioned cyber attack loss, we will assume that the bond notional is set to $ 15 million (rounding the result of EUR/$ exchange). US dollars are chosen over euros for the specific Federal Reserve (FRED) databases used in the below bond-related calculations. The bond maturity will be chosen as 3 years (this reflects a time-changing cyber security risk as well as trims large numbers obtained for longer maturities). We assume that the bond pays a coupon every half a year. There could be up to 6 coupons (we will explain “could” in a moment) during the life of the bond. From the several possible cyber bond coupon calculation techniques, two of which are considered in Section4.4, we choose the par yield approach (described in Section 4.4.2) and set bond coupon percentage to 5.09%, which amounts to 764,055.87. The funding rate for discounting during bond valuation is set to a 3-year Intercontinental Exchange (ICE) swap rate based on USD (taken from [27]) which equals 1.52% (as of August 15, 2019). The above characteristics of the cyber bond are summarized in Table 6.Table 6
Cyber bond parameters.
Bond parameterValueNotional15 millionMaturity3 yearsCoupon rate5.09%Coupon value764,055.87Funding rate1.52%We use the standard formula for bond priceP:(6)P=∑i=16C⋅e−R⋅di/365+N⋅e−R⋅d/365,where C is a coupon value, R is a funding rate, di (resp. d) is the date of the coupon payment (resp. Notional payment) in days, and N is the notional value. In our case, coupon payments are on days 182, 365, 547, 730, 912, and 1095. The last date also corresponds to the payment of the notional.With formula (6) in mind, our cyber bond is assumed to be priced as follows. In the first step, one simulates cyber losses for the bond maturity period, i.e., 3 years. This simulation includes a day of the loss and its size (cyber loss distribution parameters will be discussed in a moment). In the second step, one uses two triggers, namely, notional and coupon trigger, to determine whether coupons and notional will be paid. More precisely, for every coupon (resp. notional) one sums up the simulated losses up to the respective payment day. If the losses are strictly less than the trigger, then the respective payment is made; otherwise not. This explains our “could” used to describe the number of coupons of our proposed cyber bond. These triggers are aimed to reflect the state of the industry with respect to cyber attacks. Coupon trigger is assumed to be less than the notional trigger and should define the first level of danger (payment of all or part of the coupons is therefore dropped). Notional trigger represents the second (and highest) level of danger when measures should be taken to compensate losses (payment of the notional is thus dropped). It should be noted, however, that the triggers of other nature are also possible. For example, one could possibly watch for the appearance of a certain number of events with certain losses. One could also watch for the events of a certain nature (e.g. current ransomware attacks) or a certain sequence of cyber events reflecting some pattern. These triggers will not be considered in this paper since they require a deeper and case-specific analysis of an available and comprehensive cyber event database.


## 4.2. Cyber Loss Distribution Parameters

A word is due to the distribution of cyber losses used in this section. Following the results of Section3, we assume that cyber losses are characterized by two parameters, namely, the interval in days to the next loss and actual loss amount. Interval value is assumed to be distributed exponentially, whereas actual loss value is assumed to have a log-normal distribution. The respective parameters together with the standard errors are given in Table 7.Table 7
Cyber loss distribution parameters.
DistributionParametersStd. errorExponential (number of days till the next loss)λ=0.02110.0029Log-normal (actual loss amount)μ=14.91790.2009σ=2.34340.1421We emphasize that the arrival times of the cyber events are modeled using the exponential distribution. This is similar to the distribution, which underlies models of traded credit instruments such as, e.g., credit default swaps (CDS) (see, e.g., [28]).The parameters of Table7 were calculated from our obtained table of publicly available cyber events. This table contains 328 items, with 136 of them having publicly disclosed loss amount. These events are ranging from the years 2009–2019. The motivating event for our considered cyber bond is taken from this table. The distribution parameters themselves were obtained through the maximum-likelihood method using Nelder–Mead and Broyden–Fletcher–Goldfarb–Shanno optimization algorithms for one- and two-parameter distributions, respectively. Moreover, to estimate the exponential distribution parameter λ, we made the next two preparatory steps with the available data:(S1) The series of cyber event dates was modified to contain unique items only.(S2) The series of interval lengths between two consecutive cyber events was modified to contain unique items only.Table8 shows the results of the goodness-of-fit (GOF) tests performed by us to justify the choice of cyber loss distribution and the respective distribution parameters (notice that the null hypothesis in each of the tests says that the true distribution is the one mentioned in the first column of Table 8 with the respective parameters taken from the second column of Table 8; to reject the null hypothesis with significance level of 5%, one searches a value less than 0.05 in the last column of Table 8).Table 8
Cyber loss distribution GOF tests.
DistributionParametersGOF testTest statisticP valueExponentialλ=0.0211Chi-square4.16980.8415λ=0.0211Kolmogorov–Smirnov0.11380.4642Log-normalμ=14.9179Chi-square7.38240.8313σ=2.3434μ=14.9179Kolmogorov–Smirnov0.0570.7687σ=2.3434Additionally, Figures9 and 10 show the histograms of time interval (in days) to the next loss and actual loss amount, both with their assumed distributions.Figure 9
Histogram of time interval (in days) to the next loss and its assumed distribution.Figure 10
Histogram of actual loss amount and its assumed distribution.Backed by the results of Table8 (no rejected null hypothesis) and the visual inspection of Figures 9 and 10 (the proposed distributions are “reasonably” close to the histograms), we will rely on the cyber loss distributions and the parameters of Table 7 in the rest of the paper.Finally, we do not claim to use the all-including table of losses since many cyber events are not publicly disclosed. We do believe, however, that this table is comprehensive enough to provide numerical estimations for our considered example of cyber bonds. Moreover, similar to [29], we do believe that there already exist enough available cyber event data for the successful treatment of cyber bonds.


### 4.2.1. Distribution of Cyber Losses of Specific Type

This section answers the question on whether all cyber event types in the used database follow the same distribution. More precisely, we single out two particular cyber event groups (namely, the two biggest ones in our database) and try to find their respective loss frequency (interval length in days to the next loss) and loss severity (actual loss amount) distributions. We will follow the distribution fitting steps of Section3.(1) Cyber-Related Data Breaches. The first group contains cyber-related data breaches. We notice that this type of cyber events is extremely important for financial institutions often storing sensitive client data, which in their turn could be a lucrative target for cyber criminals. There are altogether 70 such events in our available database, with 12 of them having publicly disclosed loss amount.We first concentrate on loss frequency distribution and its parameters. Table9 shows possible loss frequency distributions of cyber-related data breach and their respective parameters with the standard errors (the reader may recall that we follow the fitting steps of Section 3 and, thus, the distributions).Table 9
Cyber-related data breach loss frequency distribution parameters.
DistributionParametersStandard errorChi-squarek=24.4751.1423Exponentialλ=0.01510.0025Fisherd1=0.660.4092d2=2.06430.6131λ=10.38344.3761Gammaα=0.59790.1179β=0.00910.0026Weibullk=0.69120.0832λ=48.503912.4018The distribution parameters of Table9 were obtained by the maximum-likelihood method using Nelder–Mead and Broyden–Fletcher–Goldfarb–Shanno optimization algorithms. The two preparatory steps from the beginning of Section 4.2 ((S1), (S2)) were taken to adjust available cyber event occurrence data.Table10 shows our performed GOF tests for the distributions of Table 9.Table 10
Cyber-related data breach loss frequency distribution of GOF tests.
DistributionParametersGOF testTest statisticP valueChi-squarek=24.475Chi square59.50.0000k=24.475Kolmogorov–Smirnov0.34790.0002Exponentialλ=0.0151Chi square12.50.0853λ=0.0151Kolmogorov–Smirnov0.27430.0069Fisherd1=0.66Chi square1.50.9927d2=2.0643λ=10.3834d1=0.66Kolmogorov–Smirnov0.05210.9999d2=2.0643λ=10.3834Gammaα=0.5979Chi square9.50.1473β=0.0091α=0.5979Kolmogorov–Smirnov0.18520.149β=0.0091Weibullk=0.6912Chi square60.4232λ=48.5039k=0.6912Kolmogorov–Smirnov0.13850.4538λ=48.5039Based on the results of Table10, namely, its last column, where the value below 0.05 leads to distribution rejection, we assume that the most suitable loss frequency distributions of cyber-related data breach are Fisher, Gamma, and Weibull with the respective parameters. After the visual inspection of Figure 11, which displays a cyber-related data breach loss frequency histogram and its assumed distributions, we conclude that the most suitable cyber-related data breach loss frequency distribution is Fisher with d1=0.66, d2=2.0643, and λ=10.3834 (where, λ is non-centrality parameter).Figure 11
Cyber data breach loss frequency histogram and its assumed distributions.We now pay attention to the loss severity distribution and its parameters. Tables11 and 12 show cyber-related data breach loss severity distribution parameters with the standard errors and the respective GOF tests.Table 11
Cyber-related data breach loss severity distribution parameters.
DistributionParametersStandard errorLog-normalμ=15.68260.759σ=2.62920.5367Table 12
Cyber-related data breach loss severity distribution of GOF test.
DistributionParametersGOF testTest statisticP valueLog-normalμ=15.6826Chi square20.5724σ=2.6292μ=15.6826Kolmogorov–Smirnov0.14160.9424σ=2.6292Based on the results of Table12, namely, its last column, we assume that the log-normal distribution with the parameters μ=15.6826 and σ=2.6292 is suitable for cyber-related data breach loss severity. This is confirmed by the visual inspection of Figure 12, which displays a cyber-related data breach loss severity histogram and its assumed distribution (notice that the number of events with publicly disclosed loss is small enough and, thus, the respective histogram has a rather awkward shape).Figure 12
Cyber data breach loss severity histogram and its assumed distribution.(2) Cyber-Related Fraud. The second group contains cyber-related fraud events, which are also an important issue for financial institutions (consider, e.g., credit card fraud or e-mail fraud; the latter is gaining in popularity more and more). There are altogether 96 such events in the available database, with 69 of them having publicly disclosed loss amount.We first study loss frequency distribution and its parameters. Table13 shows possible cyber-related fraud loss frequency distributions and their respective parameters together with the standard errors.Table 13
Cyber-related fraud loss frequency distribution parameters.
DistributionParametersStandard errorChi-squarek=21.06881.0713Exponentialλ=0.01820.0031Fisherd1=0.69830.4044d2=2.51580.8009λ=10.42614.2168Gammaα=0.61090.1226β=0.01110.0033Weibullk=0.69830.0811λ=39.49410.1437The distribution parameters of Table13 were obtained through the maximum-likelihood method with the two above-mentioned optimization algorithms. The preparatory steps of Section 4.2 ((S1), (S2)) were taken to adjust the available cyber event occurrence data.Table14 shows GOF tests for the distributions of Table 13.Table 14
Cyber-related fraud loss frequency distribution of GOF tests.
DistributionParametersGOF testTest statisticP valueChi-squarek=21.0688Chi square56.28570.0000k=21.0688Kolmogorov–Smirnov0.28390.0055Exponentialλ=0.0182Chi square11.02860.1374λ=0.0182Kolmogorov–Smirnov0.26340.0124Fisherd1=0.6983Chi square1.25710.996d2=2.5158λ=10.4261d1=0.6983Kolmogorov–Smirnov0.0481d2=2.5158λ=10.4261Gammaα=0.6109Chi square8.45710.2065β=0.0111α=0.6109Kolmogorov–Smirnov0.18460.162β=0.0111Weibullk=0.6983Chi square9.48570.148λ=39.494k=0.6983Kolmogorov–Smirnov0.12910.5602λ=39.494Based on the results of Table14, namely, its last column, where the value below 0.05 leads to distribution rejection, we assume that the most suitable cyber-related fraud loss frequency distributions are Fisher, Gamma, and Weibull. After the visual inspection of Figure 13, a displaying cyber-related data breach loss frequency histogram and its assumed distributions, we conclude that the most suitable cyber-related fraud loss frequency distribution is Fisher with d1=0.6983, d2=2.5158, and λ=10.4261 (non-centrality parameter).Figure 13
Cyber fraud loss frequency histogram and its assumed distributions.We now concentrate on the loss severity distribution and its parameters. Tables15 and 16 show cyber-related fraud loss severity distribution parameters with the standard errors and the respective GOF tests.Table 15
Cyber-related fraud loss severity distribution parameters.
DistributionParametersStandard errorLog-normalμ=14.63050.2959σ=2.45820.2093Table 16
Cyber-related fraud loss severity distribution GOF test.
DistributionParametersGOF testTest statisticP valueLog-normalμ=14.6305Chi square9.59420.2947σ=2.4582μ=14.6305Kolmogorov-smirnov0.09930.504σ=2.4582Based on the results of Table16 (namely, its last column), we assume that the log-normal distribution with the parameters μ=14.6305 and σ=2.4582 is suitable for cyber-related fraud loss severity. This is confirmed by the visual inspection of Figure 14, which displays a cyber-related fraud loss severity histogram and its assumed distribution.Figure 14
Cyber fraud loss severity histogram and its assumed distribution.In conclusion, we shall notice that even though loss severity for both the initial database and two checked event groups can be assumed to follow log-normal distribution, loss frequency distribution for the initial (exponential) database differs from that of the two considered event groups (non-central Fisher). Therefore, a particular attention to the loss frequency distribution should be paid, when working with cyber events of a specific type.


## 4.2.1. Distribution of Cyber Losses of Specific Type

This section answers the question on whether all cyber event types in the used database follow the same distribution. More precisely, we single out two particular cyber event groups (namely, the two biggest ones in our database) and try to find their respective loss frequency (interval length in days to the next loss) and loss severity (actual loss amount) distributions. We will follow the distribution fitting steps of Section3.(1) Cyber-Related Data Breaches. The first group contains cyber-related data breaches. We notice that this type of cyber events is extremely important for financial institutions often storing sensitive client data, which in their turn could be a lucrative target for cyber criminals. There are altogether 70 such events in our available database, with 12 of them having publicly disclosed loss amount.We first concentrate on loss frequency distribution and its parameters. Table9 shows possible loss frequency distributions of cyber-related data breach and their respective parameters with the standard errors (the reader may recall that we follow the fitting steps of Section 3 and, thus, the distributions).Table 9
Cyber-related data breach loss frequency distribution parameters.
DistributionParametersStandard errorChi-squarek=24.4751.1423Exponentialλ=0.01510.0025Fisherd1=0.660.4092d2=2.06430.6131λ=10.38344.3761Gammaα=0.59790.1179β=0.00910.0026Weibullk=0.69120.0832λ=48.503912.4018The distribution parameters of Table9 were obtained by the maximum-likelihood method using Nelder–Mead and Broyden–Fletcher–Goldfarb–Shanno optimization algorithms. The two preparatory steps from the beginning of Section 4.2 ((S1), (S2)) were taken to adjust available cyber event occurrence data.Table10 shows our performed GOF tests for the distributions of Table 9.Table 10
Cyber-related data breach loss frequency distribution of GOF tests.
DistributionParametersGOF testTest statisticP valueChi-squarek=24.475Chi square59.50.0000k=24.475Kolmogorov–Smirnov0.34790.0002Exponentialλ=0.0151Chi square12.50.0853λ=0.0151Kolmogorov–Smirnov0.27430.0069Fisherd1=0.66Chi square1.50.9927d2=2.0643λ=10.3834d1=0.66Kolmogorov–Smirnov0.05210.9999d2=2.0643λ=10.3834Gammaα=0.5979Chi square9.50.1473β=0.0091α=0.5979Kolmogorov–Smirnov0.18520.149β=0.0091Weibullk=0.6912Chi square60.4232λ=48.5039k=0.6912Kolmogorov–Smirnov0.13850.4538λ=48.5039Based on the results of Table10, namely, its last column, where the value below 0.05 leads to distribution rejection, we assume that the most suitable loss frequency distributions of cyber-related data breach are Fisher, Gamma, and Weibull with the respective parameters. After the visual inspection of Figure 11, which displays a cyber-related data breach loss frequency histogram and its assumed distributions, we conclude that the most suitable cyber-related data breach loss frequency distribution is Fisher with d1=0.66, d2=2.0643, and λ=10.3834 (where, λ is non-centrality parameter).Figure 11
Cyber data breach loss frequency histogram and its assumed distributions.We now pay attention to the loss severity distribution and its parameters. Tables11 and 12 show cyber-related data breach loss severity distribution parameters with the standard errors and the respective GOF tests.Table 11
Cyber-related data breach loss severity distribution parameters.
DistributionParametersStandard errorLog-normalμ=15.68260.759σ=2.62920.5367Table 12
Cyber-related data breach loss severity distribution of GOF test.
DistributionParametersGOF testTest statisticP valueLog-normalμ=15.6826Chi square20.5724σ=2.6292μ=15.6826Kolmogorov–Smirnov0.14160.9424σ=2.6292Based on the results of Table12, namely, its last column, we assume that the log-normal distribution with the parameters μ=15.6826 and σ=2.6292 is suitable for cyber-related data breach loss severity. This is confirmed by the visual inspection of Figure 12, which displays a cyber-related data breach loss severity histogram and its assumed distribution (notice that the number of events with publicly disclosed loss is small enough and, thus, the respective histogram has a rather awkward shape).Figure 12
Cyber data breach loss severity histogram and its assumed distribution.(2) Cyber-Related Fraud. The second group contains cyber-related fraud events, which are also an important issue for financial institutions (consider, e.g., credit card fraud or e-mail fraud; the latter is gaining in popularity more and more). There are altogether 96 such events in the available database, with 69 of them having publicly disclosed loss amount.We first study loss frequency distribution and its parameters. Table13 shows possible cyber-related fraud loss frequency distributions and their respective parameters together with the standard errors.Table 13
Cyber-related fraud loss frequency distribution parameters.
DistributionParametersStandard errorChi-squarek=21.06881.0713Exponentialλ=0.01820.0031Fisherd1=0.69830.4044d2=2.51580.8009λ=10.42614.2168Gammaα=0.61090.1226β=0.01110.0033Weibullk=0.69830.0811λ=39.49410.1437The distribution parameters of Table13 were obtained through the maximum-likelihood method with the two above-mentioned optimization algorithms. The preparatory steps of Section 4.2 ((S1), (S2)) were taken to adjust the available cyber event occurrence data.Table14 shows GOF tests for the distributions of Table 13.Table 14
Cyber-related fraud loss frequency distribution of GOF tests.
DistributionParametersGOF testTest statisticP valueChi-squarek=21.0688Chi square56.28570.0000k=21.0688Kolmogorov–Smirnov0.28390.0055Exponentialλ=0.0182Chi square11.02860.1374λ=0.0182Kolmogorov–Smirnov0.26340.0124Fisherd1=0.6983Chi square1.25710.996d2=2.5158λ=10.4261d1=0.6983Kolmogorov–Smirnov0.0481d2=2.5158λ=10.4261Gammaα=0.6109Chi square8.45710.2065β=0.0111α=0.6109Kolmogorov–Smirnov0.18460.162β=0.0111Weibullk=0.6983Chi square9.48570.148λ=39.494k=0.6983Kolmogorov–Smirnov0.12910.5602λ=39.494Based on the results of Table14, namely, its last column, where the value below 0.05 leads to distribution rejection, we assume that the most suitable cyber-related fraud loss frequency distributions are Fisher, Gamma, and Weibull. After the visual inspection of Figure 13, a displaying cyber-related data breach loss frequency histogram and its assumed distributions, we conclude that the most suitable cyber-related fraud loss frequency distribution is Fisher with d1=0.6983, d2=2.5158, and λ=10.4261 (non-centrality parameter).Figure 13
Cyber fraud loss frequency histogram and its assumed distributions.We now concentrate on the loss severity distribution and its parameters. Tables15 and 16 show cyber-related fraud loss severity distribution parameters with the standard errors and the respective GOF tests.Table 15
Cyber-related fraud loss severity distribution parameters.
DistributionParametersStandard errorLog-normalμ=14.63050.2959σ=2.45820.2093Table 16
Cyber-related fraud loss severity distribution GOF test.
DistributionParametersGOF testTest statisticP valueLog-normalμ=14.6305Chi square9.59420.2947σ=2.4582μ=14.6305Kolmogorov-smirnov0.09930.504σ=2.4582Based on the results of Table16 (namely, its last column), we assume that the log-normal distribution with the parameters μ=14.6305 and σ=2.4582 is suitable for cyber-related fraud loss severity. This is confirmed by the visual inspection of Figure 14, which displays a cyber-related fraud loss severity histogram and its assumed distribution.Figure 14
Cyber fraud loss severity histogram and its assumed distribution.In conclusion, we shall notice that even though loss severity for both the initial database and two checked event groups can be assumed to follow log-normal distribution, loss frequency distribution for the initial (exponential) database differs from that of the two considered event groups (non-central Fisher). Therefore, a particular attention to the loss frequency distribution should be paid, when working with cyber events of a specific type.


## 4.3. Cyber Bond Numerical Results

This subsection lists the obtained numerical results on our proposed cyber bond example. We rely on Monte Carlo simulations, with the simulation number always being 5,000.Figure15 represents quantiles of losses for the maturity period of the cyber bond, that is, 3 years. The quantiles are calculated from Monte Carlo simulations. As can be seen from Figure 15, using our generated loss distribution parameters, the losses can reach the level of $8 billion. We use these obtained loss amounts to test the influence of bond coupon and notional triggers on the actual bond parameters (e.g., price, yield, etc.).Figure 15
Quantiles of cyber losses for the period of 3 years.We have already mentioned that a bond coupon trigger can influence the number of paid coupons on the bond. We now calculate a bond coupon survival curve. As we mentioned before, the bond is assumed to pay a coupon every 6 months. Thus, altogether there are 6 coupons. Figure16 shows the probability of the payment of each coupon depending on the coupon trigger. Recall that a coupon is not paid as soon as the total losses up to the coupon payment date exceed a specific amount (bond coupon trigger). Coupon payment probability is calculated as follows. In the first step, Monte Carlo simulations give a series or 0 s and 1 s depending on whether the respective coupon was paid or not. In the second step, one calculates the probability of coupon payment as the number of 1 s divided by the number of simulations. As can be seen from Figure 16, the coupon trigger of 2.04 billion, which corresponds to about 90% quantile as per Figure 15, gives a “reasonable” coupon payment probability close to 1. The lines in Figure 16 correspond to 10%–90% loss quantiles with the uniform step chosen between them.Figure 16
Cyber bond coupon survival curve for 3 years.Similar to the coupon survival curve, we now show a notional survival curve for our proposed cyber bond. As mentioned before, the bond notional is paid back provided that the total loss up to the payment date does not exceed the bond notional trigger. Figure17 shows the probability of a notional payment for different notional triggers. The calculation methodology follows the one for the bond coupons. Notional triggers correspond to loss 10%–99% quantiles. Following Figures 15 and 17, losses above $ 2 billion (i.e., above 90% quantile) show a “reasonable” notional payment probability (above 90% as per Figure 17). In general, it is up to a risk-taker to decide which notional payment probability and, therefore, which notional trigger to choose for the issue of a cyber bond.Figure 17
Cyber bond notional survival curve for 3 years.In the next step, we are going to show our proposed cyber bond yield curve, which allows one to judge the profitability of the proposed bond. A bond yieldY is calculated by the following formula:(7)Y=CP⋅100%,where C is the bond coupon and P is the bond price. Figure 18 shows a cyber bond yield curve depending on both notional as well as coupon triggers. At least two things can be seen from the figure. First, a bond yield is not much influenced by a coupon trigger except for very small notional and coupon triggers. Second, starting from the notional trigger of about $2 billion (corresponding roughly to 90% quantile as per Figure 15), the bond yield stabilizes around 5% with the exception of a relatively small coupon trigger of $0.19 billion, for which the yield stays strictly above 5%, i.e., almost triples our assumed funding rate.Figure 18
Cyber bond yield curve.For the reader’s convenience, Figure19 shows our proposed cyber bond yield spread, i.e., the difference between the cyber bond yield and the funding rate used in the bond estimate (recall that the assumed funding rate amounts to 1.52%) depending on both coupon and notional triggers. As can be seen from the figure, the benefit of investing into our proposed cyber bond is about 3% (under “reasonable” assumptions on bond triggers).Figure 19
Cyber bond yield spread.Finally, we present our proposed cyber bond price curve. Figure20 shows that for “reasonable” coupon and notional triggers the bond price stabilizes somewhere around $ 17 million. We notice that the standard bond price (calculated by formula (6)), i.e., omitting both a coupon and a notional trigger, is 18,797,813.26.Figure 20
Cyber bond price curve.


## 4.4. Cyber Bond Risk Premium

This section considers several approaches to calculating our proposed cyber bond risk premium, namely, a bond coupon, to account for possible coupon (or even the notional itself) loss. It is up to the ultimate issuer of the cyber bond to choose the most suitable technique or invent a new one if necessary.


### 4.4.1. First Alternative: Probability of Loss

As the first approach to calculating cyber bond coupons, we take the analogy of catastrophe bonds (cat bonds for short) studied in, e.g., [30], since a cyber attack could be considered as a kind of catastrophe. A general coupon calculation formula for cat bonds can be written as follows:(8)Couponrate%=LIBOR%+Riskpremium%,where the risk premium should hedge the exposure of investors (into the bonds) to catastrophe risk (notice that following the current trend (see, e.g., [31]), LIBOR rate could be replaced by an alternative reference rate (ARR)). The above-mentioned risk premium could be then determined as follows:(9)Riskpremium%=Constant%+Lossmultiplier⋅Expectedloss%,where the expected loss is a percentage of the notional expected to be lost during the bond maturity period, the constant is the rate of return requested by investors, and the loss multiplier reflects the uncertainty related to the expected loss. For example, following the results of [30], [p. 1491], which are based on catastrophe bonds issued during the years 2006–2012 and covering earthquake risks, the constant amounts to 3.35% and the multiplier amounts to 1.4817. Additionally, as follows from the results of [32], [p. 168] based on the US catastrophe bonds issued during the years 1998–2008 and covering wind risks, the constant (resp. multiplier) amounts to 3.33% (resp. 2.4).To simplify the setting, we assume that the constant (the loss multiplier, respectively) in formula (9) is equal to 0 (resp. 1) since these parameters are highly dependent on investors. Moreover, following [15], [p. 817], we assume that expected loss EL is related to probability of loss PL and percentage of notional lost PNL given the loss occurs as follows:(10)EL%=PL⋅PNL%.In our cyber bond setting, PNL always amounts to100%, since the notional is either paid back or not paid at all (cases of the partial repayment of the bond notional, despite the fact that they are possible, are not considered in this paper). Thus, in our considered case of cyber bonds, formula (8) simplifies to(11)Couponrate%=LIBOR%+PL%.Moreover, it is clear that PL of our proposed cyber bond depends on the notional trigger. The lower is the trigger, the more probable it is that the notional will not be paid back. Since this paper does not specify a specific trigger but rather considers trigger influence on bond characteristics, we calculated the average probability of not getting back notional from the notional survival curve of Figure17. Thus, we obtain 11.58% (notice that according to [30], [p. 1490], for catastrophe bonds issued during the years 1999–2012 and covering earthquake risks, mean, maximum, and minimum risk premiums are 5.63%, 14.5%, and 1.5%, respectively, with the standard deviation being 2.70%. Therefore, our obtained number is in line with, e.g., earthquake risk). The average was taken over all the loss quantiles considered in the figure (see Section 4.3 for more details). For convenience of the reader, Figure 21 shows PL for different notional triggers. As can be seen from the figure, for low notional triggers PL could exceed 80%.Figure 21
Cyber bond probability of loss for the period of 3 years.Altogether, taking into account that 6-month LIBOR on USD (taken from, e.g., [27] on August 15, 2019) is 2.05% and that our proposed cyber bond pays a coupon every 6 months, the total bond coupon resulting from the first coupon calculation technique (i.e., according to formula (11)) is 13.63%.


### 4.4.2. Second Alternative: Par Yield

As the second approach to cyber bond coupon calculation, we consider the concept of a bond par yield. Recall from, e.g., [33], [p. 85] that a bond par yield is a coupon rate for which the bond price equals its par value, namely, the notional value. It is easy to see (taking into consideration formula (6)) that the bond coupon C for par yield can be calculated as follows (keeping in mind that N is bond notional):(12)C=N⋅1−e−R⋅d/365∑i=16e−R⋅di/365.The respective par yield PY is then derived as(13)PY=CN⋅100%=1−e−R⋅d/365∑i=16e−R⋅di/365⋅100%.The obtained par yield PY is then set to be the bond coupon rate.In the case of our proposed cyber bond, some of the coupons and even the notional itself may not be paid back to the bondholder, which depends on the actual cyber losses. Thus, we first simulate cyber losses for the bond maturity period and then calculate cyber bondPY by formula (13), where now some of e−R⋅di/365 and even e−R⋅d/365 may be taken 0 depending on whether the respective item is paid to the bondholder or not.Figure22 shows the obtained par yield curves depending on both notional and coupon triggers. Since none of the triggers (both depending on the actual bond issuer) is fixed in this paper, we calculate the final coupon percentage as the average par yield over all the obtained curves getting thus 5.09% (recall from Section 4.1 that this amounts to $764,055.87 as per assumed bond notional of $15 million).Figure 22
Cyber bond par yield curve.In order to be more aggressive in bond coupons, one could increase the parameters of Table7, namely, the loss frequency (severity) parameter λ (resp. μ). As an example, Figures 23 and 24 show par yield curves for 25% (resp. 5%) increase of λ (resp. μ) value. The resulting cyber bond par yields are then 6.52% and 10.92%, respectively. One could tune both parameters increase according to the needs of the bond issuer. It is also easy to see that the unreasonable increase of the loss severity parameter μ could badly influence a bond coupon rate (namely, in the current cyber bond setting, 5% increase of μ almost doubles the coupon rate obtained through 25% increase of λ).Figure 23
Cyber bond par yield curve for loss frequency parameterλ increase of 25%.Figure 24
Cyber bond par yield curve for loss severity parameterμ increase of 5%.Notice that increasing the cyber loss frequency or severity parameter will influence other cyber bond characteristics as well. For example, Figures25–27 show cyber bond spreads (namely, bond coupon percentage minus funding rate) for initial λ and μ as well as their increased values for 25% and 5%, respectively.Figure 25
Cyber bond spread.Figure 26
Cyber bond spread for loss frequency parameterλ increase of 25%.Figure 27
Cyber bond spread for loss severity parameterμ increase of 5%.Additionally, Figures28 and 29 show the bond notional survival curves for loss frequency λ and loss severity μ in the intervals λ±λ⋅25% and μ±μ⋅5%, respectively. It can be easily seen from Figure 29 that 5% loss severity parameter increase visibly reduces notional payment probability with the set of current possible notional triggers.Figure 28
Cyber bond notional survival curve for 3 years forλ in the interval λ±λ⋅25%.Figure 29
Cyber bond notional survival curve for 3 years forμ in the interval μ±μ⋅5%.Finally, Figures30 and 31 show the probability of (notional) loss PL for different notional triggers for loss frequency λ and loss severity μ in the intervals λ±λ⋅25% and μ±μ⋅5%, respectively. These two figures just mirror the results of Figures 28 and 29.Figure 30
Cyber bond probability of loss for 3 years forλ in the interval λ±λ⋅25%.Figure 31
Cyber bond probability of loss for 3 years forμ in the interval μ±μ⋅5%.


## 4.4.1. First Alternative: Probability of Loss

As the first approach to calculating cyber bond coupons, we take the analogy of catastrophe bonds (cat bonds for short) studied in, e.g., [30], since a cyber attack could be considered as a kind of catastrophe. A general coupon calculation formula for cat bonds can be written as follows:(8)Couponrate%=LIBOR%+Riskpremium%,where the risk premium should hedge the exposure of investors (into the bonds) to catastrophe risk (notice that following the current trend (see, e.g., [31]), LIBOR rate could be replaced by an alternative reference rate (ARR)). The above-mentioned risk premium could be then determined as follows:(9)Riskpremium%=Constant%+Lossmultiplier⋅Expectedloss%,where the expected loss is a percentage of the notional expected to be lost during the bond maturity period, the constant is the rate of return requested by investors, and the loss multiplier reflects the uncertainty related to the expected loss. For example, following the results of [30], [p. 1491], which are based on catastrophe bonds issued during the years 2006–2012 and covering earthquake risks, the constant amounts to 3.35% and the multiplier amounts to 1.4817. Additionally, as follows from the results of [32], [p. 168] based on the US catastrophe bonds issued during the years 1998–2008 and covering wind risks, the constant (resp. multiplier) amounts to 3.33% (resp. 2.4).To simplify the setting, we assume that the constant (the loss multiplier, respectively) in formula (9) is equal to 0 (resp. 1) since these parameters are highly dependent on investors. Moreover, following [15], [p. 817], we assume that expected loss EL is related to probability of loss PL and percentage of notional lost PNL given the loss occurs as follows:(10)EL%=PL⋅PNL%.In our cyber bond setting, PNL always amounts to100%, since the notional is either paid back or not paid at all (cases of the partial repayment of the bond notional, despite the fact that they are possible, are not considered in this paper). Thus, in our considered case of cyber bonds, formula (8) simplifies to(11)Couponrate%=LIBOR%+PL%.Moreover, it is clear that PL of our proposed cyber bond depends on the notional trigger. The lower is the trigger, the more probable it is that the notional will not be paid back. Since this paper does not specify a specific trigger but rather considers trigger influence on bond characteristics, we calculated the average probability of not getting back notional from the notional survival curve of Figure17. Thus, we obtain 11.58% (notice that according to [30], [p. 1490], for catastrophe bonds issued during the years 1999–2012 and covering earthquake risks, mean, maximum, and minimum risk premiums are 5.63%, 14.5%, and 1.5%, respectively, with the standard deviation being 2.70%. Therefore, our obtained number is in line with, e.g., earthquake risk). The average was taken over all the loss quantiles considered in the figure (see Section 4.3 for more details). For convenience of the reader, Figure 21 shows PL for different notional triggers. As can be seen from the figure, for low notional triggers PL could exceed 80%.Figure 21
Cyber bond probability of loss for the period of 3 years.Altogether, taking into account that 6-month LIBOR on USD (taken from, e.g., [27] on August 15, 2019) is 2.05% and that our proposed cyber bond pays a coupon every 6 months, the total bond coupon resulting from the first coupon calculation technique (i.e., according to formula (11)) is 13.63%.


## 4.4.2. Second Alternative: Par Yield

As the second approach to cyber bond coupon calculation, we consider the concept of a bond par yield. Recall from, e.g., [33], [p. 85] that a bond par yield is a coupon rate for which the bond price equals its par value, namely, the notional value. It is easy to see (taking into consideration formula (6)) that the bond coupon C for par yield can be calculated as follows (keeping in mind that N is bond notional):(12)C=N⋅1−e−R⋅d/365∑i=16e−R⋅di/365.The respective par yield PY is then derived as(13)PY=CN⋅100%=1−e−R⋅d/365∑i=16e−R⋅di/365⋅100%.The obtained par yield PY is then set to be the bond coupon rate.In the case of our proposed cyber bond, some of the coupons and even the notional itself may not be paid back to the bondholder, which depends on the actual cyber losses. Thus, we first simulate cyber losses for the bond maturity period and then calculate cyber bondPY by formula (13), where now some of e−R⋅di/365 and even e−R⋅d/365 may be taken 0 depending on whether the respective item is paid to the bondholder or not.Figure22 shows the obtained par yield curves depending on both notional and coupon triggers. Since none of the triggers (both depending on the actual bond issuer) is fixed in this paper, we calculate the final coupon percentage as the average par yield over all the obtained curves getting thus 5.09% (recall from Section 4.1 that this amounts to $764,055.87 as per assumed bond notional of $15 million).Figure 22
Cyber bond par yield curve.In order to be more aggressive in bond coupons, one could increase the parameters of Table7, namely, the loss frequency (severity) parameter λ (resp. μ). As an example, Figures 23 and 24 show par yield curves for 25% (resp. 5%) increase of λ (resp. μ) value. The resulting cyber bond par yields are then 6.52% and 10.92%, respectively. One could tune both parameters increase according to the needs of the bond issuer. It is also easy to see that the unreasonable increase of the loss severity parameter μ could badly influence a bond coupon rate (namely, in the current cyber bond setting, 5% increase of μ almost doubles the coupon rate obtained through 25% increase of λ).Figure 23
Cyber bond par yield curve for loss frequency parameterλ increase of 25%.Figure 24
Cyber bond par yield curve for loss severity parameterμ increase of 5%.Notice that increasing the cyber loss frequency or severity parameter will influence other cyber bond characteristics as well. For example, Figures25–27 show cyber bond spreads (namely, bond coupon percentage minus funding rate) for initial λ and μ as well as their increased values for 25% and 5%, respectively.Figure 25
Cyber bond spread.Figure 26
Cyber bond spread for loss frequency parameterλ increase of 25%.Figure 27
Cyber bond spread for loss severity parameterμ increase of 5%.Additionally, Figures28 and 29 show the bond notional survival curves for loss frequency λ and loss severity μ in the intervals λ±λ⋅25% and μ±μ⋅5%, respectively. It can be easily seen from Figure 29 that 5% loss severity parameter increase visibly reduces notional payment probability with the set of current possible notional triggers.Figure 28
Cyber bond notional survival curve for 3 years forλ in the interval λ±λ⋅25%.Figure 29
Cyber bond notional survival curve for 3 years forμ in the interval μ±μ⋅5%.Finally, Figures30 and 31 show the probability of (notional) loss PL for different notional triggers for loss frequency λ and loss severity μ in the intervals λ±λ⋅25% and μ±μ⋅5%, respectively. These two figures just mirror the results of Figures 28 and 29.Figure 30
Cyber bond probability of loss for 3 years forλ in the interval λ±λ⋅25%.Figure 31
Cyber bond probability of loss for 3 years forμ in the interval μ±μ⋅5%.


## 4.5. Simple Result Analysis

The numerical results of Section4.3 show that the choice of notional and in some cases, coupon trigger could significantly influence our proposed cyber bond parameters. For example, as follows from Figure 18, under the small notional and coupon triggers, the cyber bond yield could reach double-digits. Such a high bond yield, however, comes from a rather low bond price as per Figure 20. It is additionally influenced by the bond risk premium, which should be tuned to the needs of a specific investor. Under the “reasonable” notional and coupon triggers, as follows from Figure 19, the benefit of investing into our proposed cyber bond over relying on the funding rate is about 3%. Since we propose a general cyber bond framework only, it is up to the actual risk-taker to decide which notional and coupon trigger should be deemed reasonable. Moreover, other trigger types (instead of just summing up losses up to a certain date) could be explored in case it is necessary for the bond issuer as mentioned at the end of Section 4.1.The two techniques to calculate a cyber bond coupon rate considered in Section4.4 could provide an entry point for the actual calculations done by the bond issuer. The expected loss approach (taken from the setting of cat bonds) provides a higher coupon rate in comparison with the par yield approach (13.63% versus 5.09%, respectively). The latter rate, however, could be easily increased through changing the cyber loss frequency and loss severity parameters (to 6.52% and 10.92%, respectively). Changing those parameters though could lead to a significant worsening of other cyber bond characteristics, e.g., increasing the probability of the notional loss for the notional trigger.Finally, we would like to emphasize that due to lack of properly developed cyber bond framework in the literature, we are unable to make a proper comparison of our setting with some other main-stream techniques. For example, Xu and Zhang [21] rely on the setting of cat bonds to deal with the insurance of losses of a cyber-related data breach. In particular, they develop a multi-period pricing model for data breach cat bonds by combining data breach risks and financial market risks based in the equilibrium pricing theory. The main advantage of our approach is two-fold: it is simple and also sufficiently general to be applied to any type of cyber-related loss. For instance, we can easily switch from cyber-related data breach to cyber-related fraud, both of which were considered in this section. Moreover, while calculating the coupons of a cyber bond, we do not only follow the classical cat bond approach but also present an alternative par yield technique, which could be more suitable for cyber bonds, since cyber events are essentially different from the classical catastrophe events (like, e.g., hurricanes) in terms of, e.g., that the actual loss caused by a cyber event is not always seen immediately.


## 5. Conclusion

This paper presented a general setting of cyber bonds and considered a specific and extensive cyber bond example, including a bond price, yield, risk premium, etc. The setting appears to be convenient to use and could be easily tuned to the needs of the bond issuer. Moreover, we showed that the publicly available cyber loss event databases provide enough information to estimate the cyber loss severity and frequency distributions. Finally, two important points arose from our investigation. First, the proposed cyber bond characteristics are heavily influenced by coupon and notional triggers (determining the payment of bond coupons and notional, respectively). Second, the loss frequency distribution of specific cyber event groups can be different from that of the whole cyber event database. Both points should be necessarily cared about by the bond issuer.For several years, several financial institutions have been using operational risk securities that specifically cover cyber risk. The materiality of these securities is growing constantly, and the separation of their scope is a matter of time. The proposed new type of financial instruments based on cyber risk allows satisfying the investors’ demand for the range of available products and extend the range of potential returns and risks. On the other hand, issuers will be able to decrease coupon payments as compared to operational risk securities and mitigate the damage from cyberattacks.The proposed financial instrument factors in the accidental occurrence of cyber incidents and unexpected losses after such events. It is considered that losses cannot be defined promptly. Thus, the modeled loss trigger is used to catch the moment of a potential cyberattack.The proposed cyber risk securities are the instruments of current interest since it is complicated to predict the underlying risk. Furthermore, we currently have no methods to assess the potential damage from a cyberattack as far as the real damage immediately after the incident.Further research is aimed at finding a method that will allow assessing losses from a cyber incident immediately. Thus, we will be able to use an indemnity trigger in the corresponding financial instrument.



---

*Source: 7689828-2022-12-31.xml*