A stochastic SIR model for cyber contagion: application to granular growth of firms and to insurance portfolio

Paper: arXiv 2603.15369

Authors: Caroline Hillairet, Olivier Lopez, Lionel Sopgoui

Abstract

This work evaluates the impact of contagious cyber-events, over a finite horizon, on firms’ financial health and on a cyber insurance portfolio. Our approach builds on key empirical findings from economics and cybersecurity. In economics, firm size and growth-rate distributions are non-Gaussian and exhibit heavy tails. In cybersecurity, contagion dynamics strongly depend on firm size and environmental conditions. To capture these features, we propose a stochastic multi-group SIR model coupled with a granular model of firm growth. This framework allows us to quantify the financial impact of cyber-attacks on firms’ revenues and on the insurer’s portfolio. In the model, the arrival time and duration of cyber-attacks are driven by a combination of a Cox process and a Bernoulli random variable. The Cox process represents external contagion, with an intensity given by the force of infection derived from the stochastic SIR dynamics. The Bernoulli component captures contagion originating from an infected sister or subsidiary firm. Environmental variability enables stochastic scenario generation and the computation of aggregate exceedance probabilities, a standard metric in catastrophe modeling that provides insurers with immediate insight into the financial severity of an event. We apply the framework to the LockBit ransomware attacks observed between May and July 2024. For a portfolio of 2,929 firms located in Ile-de-France, the model predicts that, with 50% probability, the insurer will need to compensate losses equivalent to up to two days of revenue over a 100-day cyber incident.

Complexity vs Empirical Score

• Math Complexity: 6.5/10
• Empirical Rigor: 7.0/10
• Quadrant: Holy Grail — high math complexity, high empirical rigor

Why this score: The paper presents an innovative integration of a stochastic multi-group SIR epidemiological model with firm growth dynamics to assess cyber contagion and insurance losses. It grounds the empirical application in actual LockBit ransomware data, providing strong practical relevance for cyber risk modeling and catastrophe insurance.

Research Flowchart

  flowchart TD
    A["Research Goal:<br>Quantify financial impact of contagious cyber-attacks<br>on firms and insurance portfolios"] --> B["Data & Inputs:<br>2,929 Ile-de-France firms<br>LockBit ransomware data (May-Jul 2024)<br>Firm size & growth distributions"]
    
    B --> C["Stochastic Multi-Group SIR Model:<br>Captures size-dependent cyber contagion<br>& environmental variability"]
    
    C --> D["Loss & Attack Simulation:<br>Cox Process (external infection force)<br>+ Bernoulli RV (subsidiary contagion)<br>+ Granular firm growth model"]
    
    D --> E["Key Outcome:<br>Generated Aggregate Exceedance Probabilities<br>50% chance of insurer compensating ≤2 days<br>of revenue loss over 100-day incident"]

Cited References (43)

1. Revisiting Granular Models of Firm Growth (2024) — link
2. Firm volatility in granular networks (2020)
3. SIR Model for Households (2024)
4. Cyber contagion: impact of the network structure on the losses of an insurance portfolio (2022)
5. Propagation of cyber incidents in an insurance portfolio: counting processes combined with compartmental epidemiological models (2021)
6. Long-time behaviour of a perturbed SIR model by white noise (2013)
7. Threshold of a stochastic SIR epidemic model with L 'e vy jumps (2016)
8. Multigroup SIR epidemic model with stochastic perturbation (2011)

2 of 43 cited works are in the corpus; resolved via arXiv source bundles, Semantic Scholar and OpenAlex. Corpus-wide: 2518 linked papers.