  We introduce a game-theoretic model to investigate the strategic interaction
between a cyber insurance policyholder whose premium depends on her
self-reported security level and an insurer with the power to audit the
security level upon receiving an indemnity claim. Audits can reveal fraudulent
(or simply careless) policyholders not following reported security procedures,
in which case the insurer can refuse to indemnify the policyholder. However,
the insurer has to bear an audit cost even when the policyholders have followed
the prescribed security procedures. As audits can be expensive, a key problem
insurers face is to devise an auditing strategy to deter policyholders from
misrepresenting their security levels to gain a premium discount. This
decision-making problem was motivated by conducting interviews with
underwriters and reviewing regulatory filings in the U.S.; we discovered that
premiums are determined by security posture, yet this is often self-reported
and insurers are concerned by whether security procedures are practised as
reported by the policyholders.
  To address this problem, we model this interaction as a Bayesian game of
incomplete information and devise optimal auditing strategies for the insurers
considering the possibility that the policyholder may misrepresent her security
level. To the best of our knowledge, this work is the first theoretical
consideration of post-incident claims management in cyber security. Our model
captures the trade-off between the incentive to exaggerate security posture
during the application process and the possibility of punishment for
non-compliance with reported security policies. Simulations demonstrate that
common sense techniques are not as efficient at providing effective cyber
insurance audit decisions as the ones computed using game theory.
