Moral hazard

Moral hazard refers to the change in an economic agent's behavior once it is protected against the consequences of its actions, here once insured. Covered against a risk, the insured may relax its caution, invest less in prevention or become less careful, which increases the probability or severity of the loss. Unlike adverse selection, which arises before underwriting and stems from hidden information, moral hazard arises after underwriting and stems from a hidden action the insurer cannot perfectly observe. The mechanisms designed to contain it all aim to re-expose the insured to the consequences of the loss, deductibles, caps, bonus-malus systems, loss sharing, prevention conditions imposed by the contract. In cyber insurance, moral hazard is a genuine concern, because overly generous cover can deter a firm from investing in its security or hardening its backups, or even facilitate ransom payment. This is why cyber insurers frequently impose minimum security requirements, significant deductibles and crisis-management conditions. The AlgoPolis paper further observes that the algorithmic agent, devoid of its own intentionality, does not present classic moral hazard, but that a new kind of opacity replaces that behavioral risk.

A firm generously insured against ransomware neglects to update its systems, reckoning that insurance will cover the consequences; the insurer then imposes a high deductible and regular security audits.

aléa moral, risque moral, moral hazard