  Cyber insurance is a risk-sharing mechanism that can improve cyber-physical
systems (CPS) security and resilience. The risk preference of the insured plays
an important role in cyber insurance markets. With the advances in information
technologies, it can be reshaped through nudging, marketing, or other types of
information campaigns. In this paper, we propose a framework of risk preference
design for a class of principal-agent cyber insurance problems. It creates an
additional dimension of freedom for the insurer for designing
incentive-compatible and welfare-maximizing cyber insurance contracts.
Furthermore, this approach enables a quantitative approach to reduce the moral
hazard that arises from information asymmetry between the insured and the
insurer. We characterize the conditions under which the optimal contract is
monotone in the outcome. This justifies the feasibility of linear contracts in
practice. This work establishes a metric to quantify the intensity of moral
hazard and create a theoretic underpinning for controlling moral hazard through
risk preference design. We use a linear contract case study to show numerical
results and demonstrate its role in strengthening CPS security.
