Moral hazard
The tendency of an insured to change behavior and relax caution once covered.
Kenneth Arrow framed the problem in 1963, in "Uncertainty and the Welfare Economics of Medical Care" (American Economic Review): the insured behaves differently because they are insured. Once covered, they relax their caution, invest less in prevention or grow less careful, and the probability or severity of loss goes up. Adverse selection arises before underwriting and stems from hidden information; moral hazard arises afterward, and stems from a hidden action the insurer observes only imperfectly. Every remedy puts the insured back on the hook for the loss: deductibles, limits, bonus-malus, loss sharing, prevention conditions written into the policy. In cyber, the concern is concrete. Overly generous cover can deter a firm from investing in its security or hardening its backups, or even ease the payment of a ransom. Hence the minimum security requirements, high deductibles and crisis-management conditions of cyber policies. The AlgoPolis paper notes that the algorithmic agent, having no intent of its own, does not present classic moral hazard, but that a new kind of opacity takes its place.
Textbook case: a firm generously insured against ransomware neglects to update its systems, reckoning that insurance will cover the consequences; the insurer then imposes a high deductible and regular security audits.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.