Systemic Cyber Risk: Linking Measurement, Market Incentives, and Policy

Many firms and sectors within the global economy heavily depend on a common set of critical technology products and software services, thereby consolidating risk across a small number of potential failure points. The widespread reliance on a limited set of products and services has given rise to many single points of system vulnerability. Such concentration of risk amplifies the potential fallout from security breaches, especially since attackers have strong incentives to attack such products and services. Despite the abundance of tools available to organizations and consumers for safeguarding their data against loss or compromise, advancements in individual defense measures have been more than counterbalanced by an increased susceptibility to systemic events. In this paper, we apply economic principles to the rising danger of systemic cyber risks. The paper is organized around four central economic lessons and uses case studies, new data, and policy discussion to develop and support them.