Optimism bias and its impact on cyber risk management decisions

Abstract

This study explores how optimism bias influences decision-making in cyber risk management by developing a novel model that reflects utility loss aversion, a factor previously unexplored in this context. We find that decision-makers with self-protection as reference point are less likely to invest in other cyber risk management measures, providing support for optimism bias observed in the cyber-insurance market. We also show that decision-makers with higher loss aversion tend to not invest in other cyber risk management measures. Our results help to explain the lack of demand for cyber-insurance and have important implications for corporate risk management and public policy on cyber risk. They also help better understand cyber risk events which can trigger huge systemic consequences for economies and societies.