Cyber Risk Aggregation and Capital Modeling for Insurance Portfolios
Undergraduate dissertation, advised by Prof. Guo Liu · 2026 – presentIn progress
Cyber losses violate the assumption most actuarial models are built on: attacks do not arrive independently. A single worm, a shared cloud provider, or one widely deployed vulnerability can put many policyholders on claim at the same time, so an insurer that prices each risk in isolation will systematically underestimate how much capital the portfolio needs.
This project builds the risk chain one layer at a time, from the position of the insurer rather than a single firm. A multivariate Hawkes process, indexed by the insured firms, supplies the attack arrivals: dependence between firms is generated endogenously by cross-excitation rather than imposed afterwards through a copula, so it is strongest during precisely the outbreaks that drive the tail. A stochastic Gordon–Loeb layer maps those arrivals into breach probabilities and heavy-tailed losses; the resulting aggregate loss distribution drives the capital layer, where value-at-risk, tail value-at-risk and an Euler allocation are measured against a Poisson benchmark of the same expected frequency; and the last layer is risk transfer, where a reinsurance retention level is chosen and re-solved at several initial threat levels.
My submitted proposal also carried a dynamic version of that last layer: a stochastic control problem in surplus and attack intensity, whose value function should solve a Hamilton–Jacobi–Bellman partial integro-differential equation. My supervisor judged it infeasible within an undergraduate timeline — the verification theorem is a research problem in itself, and it was the one component I could not check against the simulation engine — and I agreed, so it now stands in the thesis as future work. The thesis stops at the static retention problem.
As of September 2026 the proposal is submitted and the modelling scope is agreed with my supervisor. The simulation engine is the immediate next step, and no numerical results exist yet.