Fear and loathing in the cyber insurance market: How a hyperbolized view of cyber war has led to an economic security problem

The global insurance and reinsurance ("re/insurance") industry has found itself in a puzzling situation - one that generally has not been explored. The industry has taken a strong, vocal, and public view that cyber war poses an existential threat its viability. The research undertaken in this thesis focuses on the overarching research question: What is the relationship between the insurance industry and cyber security with regard to cyber war? To address the overarching research question, this thesis explores a series interrelated and cumulative research questions that ultimately build to a view of their relationship.

The first two research questions establish a foundation, first by probing the robustness of the re/insurance industry's understanding of cyber security with regard to the potential economic effects of cyber war and then by exploring the reasons why the re/insurance industry's hyperbolic view of cyber war persists. Specifically, this involves a careful review of the size and structure of the cyber re/insurance sector, past loss experience, and adjacent economic impacts, followed by a detailed examination of how the economic effects of seemingly major events - both experienced and imagined - either have materialized or how they would compare to similar loss experiences from events not caused by cyber operations (e.g., mass power outages and transportation disruption.

The remaining two research questions focus on the consequences of the re/insurance industry's view of cyber war risk. In particular, the impact of a hyperbolized view of war on the cyber "protection gap" - i.e., the extent to which insurance is not available relative to the nature of the risk - is used to show how an understanding of cyber war at odds with empirical evidence and prevailing analysis can lead to economic security vulnerability. To improve the economic security of those who believe they face cyber war risk, this thesis proposes a novel approach to securitization as a way to maintain a healthy respect for cyber risks without allowing an abundance of caution may exacerbate the threat it seeks to avoid. "In-securitization," offered in this thesis, allows for a reduction in the extent to which cyber war is securitized within the economic security sector while still recognizing the need for securitization.

The findings in this thesis make several contributions to the scholarship on cyber conflict, economic security, and securitization theory. First, they challenge the prevailing views on cyber war held by the re/insurance industry and reveal limitations in the industry's understanding of cyber war, offensive cyber operations, and cyber catastrophe events more broadly. The thesis also remedies popular misunderstandings and mischaracterizations of the economic and insurance effects of NotPetya, the effects of which became foundational to the securitization of cyber war by the re/insurance industry. Finally, this thesis links the securitization of cyber war to the heavy repetition and amplification of the belief that cyber war is uninsurable (due to the misunderstanding of NotPetya) and introduces in-securitization theory as a way to recognize industry concerns without necessarily impeding capital flows.