Please use this identifier to cite or link to this item: https://hdl.handle.net/10419/307088 
Year of Publication: 
2023
Citation: 
[Journal:] The Geneva Papers on Risk and Insurance - Issues and Practice [ISSN:] 1468-0440 [Volume:] 48 [Issue:] 2 [Publisher:] Springer Nature [Place:] Berlin [Year:] 2023 [Pages:] 463-501
Publisher: 
Springer Nature, Berlin
Abstract: 
Cyber incidents are among the most critical business risks for organisations and can lead to large financial losses. However, previous research on loss modelling is based on unassured data sources because the representativeness and completeness of op-risk databases cannot be assured. Moreover, there is a lack of modelling approaches that focus on the tail behaviour and adequately account for extreme losses. In this paper, we introduce a novel 'tempered' generalised extreme value (GEV) approach. Based on a stratified random sample of 5000 interviewed German organisations, we model different loss distributions and compare them to our empirical data using graphical analysis and goodness-of-fit tests. We differentiate various subsamples (industry, size, attack type, loss type) and find our modified GEV outperforms other distributions, such as the lognormal and Weibull distributions. Finally, we calculate losses for the German economy, present application examples, derive implications as well as discuss the comparison of loss estimates in the literature.
Subjects: 
Cyber incident losses
Loss size distribution
Extreme value distribution
Tapered distribution
Information security management
Data breach
Persistent Identifier of the first edition: 
Creative Commons License: 
cc-by Logo
Document Type: 
Article
Document Version: 
Published Version

Files in This Item:
File
Size





Items in EconStor are protected by copyright, with all rights reserved, unless otherwise indicated.