Vine copula modeling dependence among cyber risks: A dangerous regulatory paradox

Dependence among different cyber risk classes is a fundamentally underex-plored topic in the literature. However, disregarding the dependence structurein cyber risk management leads to inconsistent estimates of potential unin-tended losses. To bridge this gap, this article adopts a regulatory perspectiveto develop vine copulas to capture dependence. In quantifying the solvencycapital requirement gradient for cyber risk measurement according to Sol-vency II, a dangerous paradox emerges: an insurance company does not tend toprovide cyber risk hedging products as they are excessively expensive and wouldrequire huge premiums that it would not be possible to find policyholders