Paper: arXiv 2507.08193

Authors: Jiayi Guo, Zhiyu Quan, Linfeng Zhang

Abstract

The lack of high-quality public cyber incident data limits empirical research and predictive modeling for cyber risk assessment. This challenge persists due to the reluctance of companies to disclose incidents that could damage their reputation or investor confidence. Therefore, from an actuarial perspective, potential resolutions conclude two aspects: the enhancement of existing cyber incident datasets and the implementation of advanced modeling techniques to optimize the use of the available data. A review of existing data-driven methods highlights a significant lack of entity-specific organizational features in publicly available datasets. To address this gap, we propose a novel InsurTech framework that enriches cyber incident data with entity-specific attributes. We develop various machine learning (ML) models: a multilabel classification model to predict the occurrence of cyber incident types (e.g., Privacy Violation, Data Breach, Fraud and Extortion, IT Error, and Others) and a multioutput regression model to estimate their annual frequencies. While classifier and regressor chains are implemented to explore dependencies among cyber incident types as well, no significant correlations are observed in our datasets. Besides, we apply multiple interpretable ML techniques to identify and cross-validate potential risk factors developed by InsurTech across ML models. We find that InsurTech empowered features enhance prediction occurrence and frequency estimation robustness compared to only using conventional risk factors. The framework generates transparent, entity-specific cyber risk profiles, supporting customized underwriting and proactive cyber risk mitigation. It provides insurers and organizations with data-driven insights to support decision-making and compliance planning.

Complexity vs Empirical Score

  • Math Complexity: 3.5/10
  • Empirical Rigor: 7.5/10
  • Quadrant: Street Traders — practical and empirical, lighter on theory

Why this score: The paper addresses a critical practical issue in cyber insurance by enriching scarce public incident datasets with firm-specific InsurTech features. It uses empirical machine learning models (multilabel classification, multioutput regression, and interpretable ML) rather than dense mathematical derivations to demonstrate improvements in entity-level risk assessment.

Research Flowchart

  flowchart TD
    A[Research Goal: Entity-Specific Cyber Risk Assessment] --> B[Input Data: Public Cyber Incidents + InsurTech Entity Features]
    B --> C[ML Modeling: Multilabel Classification & Multioutput Regression]
    C --> D[Model Exploration: Classifier/Regressor Chains & Interpretable ML]
    D --> E[Outcome: Enhanced Occurrence & Frequency Prediction]
    D --> F[Outcome: Transparent Entity-Specific Cyber Risk Profiles & Risk Factors]

Cited References (44)

  1. Addressing insurance of data breach cyber risks in the catastrophe framework
  2. Analysis of the impact of cyber events for cyber insurance
  3. An empirical investigation of the relationship between local government budgets, IT expenditures, and cyber losses
  4. Classifier chains for multi-label classification
  5. Classifying cyber events
  6. Copula approaches for modeling cross-sectional dependence of data breach losses
  7. Cyber security: Underpinning the digital economy — [link](https://www.iod.com/Portals/0/PDFs/Campaigns and Reports/Digital and Technology/Cyber Security -Underpinning the digital economy.pdf)
  8. Cost of a data breach 2024 \textbar IBM — link
and 36 more
  1. Examining the costs and causes of cyber incidents
  2. Exposure measures for pricing and analyzing the risks in cyber insurance
  3. Insurability of cyber risk: An empirical analysis
  4. Modeling and predicting cyber hacking breaches
  5. Multi-label classification: An overview
  6. The Data Breach Chronology — link
  7. VCDB : VERIS community database — link
  8. When is a cyber incident likely to be litigated and how much will it cost? An empirical study
  9. A free and community-driven critical infrastructure ransomware dataset
  10. Dataset of data breaches and ransomware attacks over 15 years from 2004
  11. Pwned websites — link
  12. DataBreaches .net — link
  13. DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning (2025) — link
  14. What are the actual costs of cyber risk events?
  15. Modelling and predicting enterprise-level cyber risks in the context of sparse data availability
  16. Content analysis of cyber insurance policies: how do carriers price cyber risk?
  17. Incident-specific cyber insurance — → 2308.00921
  18. Improving Business Insurance Loss Models by Leveraging InsurTech Innovation — → 2401.16723
  19. A survey on multi label classification (2018)
  20. A survey on multi-output regression (2015)
  21. Performance metrics for multilabel emotion classification: comparing micro, macro, and weighted f1-scores (2024)
  22. The data that drives cyber insurance: a study into the underwriting and claims processes
  23. Cyber insurance: state of the art, trends and future directions
  24. Multi-label classification methods for multi-target regression (2012) — link
  25. A review on random forest: An ensemble classifier (2018)
  26. Lightgbm: A highly efficient gradient boosting decision tree (2017)
  27. Random forests (2001)
  28. Predictive analytics of insurance claims using multivariate decision trees (2018)
  29. Manual on setting up, using, and understanding random forests v3. 1 (2002)
  30. A note on the calculation and interpretation of the Gini index (1984)
  31. Information gain and a general measure of correlation (1983)
  32. All models are wrong, but many are useful: Learning a variable’s importance by studying an entire class of prediction models simultaneously (2019)
  33. From local explanations to global understanding with explainable AI for trees (2020)
  34. A unified approach to interpreting model predictions (2017)
  35. NLP-Powered Repository and Search Engine for Academic Papers: A Case Study on Cyber Risk Literature with CyLit (2025)
  36. A Taxonomy of Operational Cyber Security Risks Version 2: — link

2 of 44 cited works are in the corpus; resolved via arXiv source bundles, Semantic Scholar and OpenAlex. Corpus-wide: 2518 linked papers.