Actuarial Insights into Cyber Attack Trends – Project Story

Inspiration

The 2024 cyberattack on Star Health exposed the personal and medical data of more than 31 million policyholders. What struck us most was how a single vulnerability—an IDOR flaw—led to financial losses, regulatory fines, operational failures, and a serious collapse of trust.

As actuarial students, we realised something important: Cybersecurity failures are not just technical problems; they are actuarial risk problems.

This incident inspired us to explore how actuarial tools could help quantify, model, and reduce the financial uncertainty caused by cyberattacks.

What it does

Our project introduces an interactive Cyber Risk Prototype Dashboard built in R and Shiny. The dashboard lets users simulate cyber breach scenarios—mild, moderate, and severe—while adjusting:

• breach impact percentage
• safety factor
• risk transfer to reinsurers

The underlying calculations follow simple actuarial logic:

[ \text{Expected Loss} = (\text{Claims} + \text{Fines} + \text{Operational Loss}) \times \text{Impact Percentage} ]

[ \text{Reserve Required} = \text{Expected Loss} \times \text{Safety Factor} ]

For each scenario, the dashboard instantly shows:

• estimated total loss
• required reserve
• retained vs. transferred risk

Interactive plots and tables make the numbers easy to understand for both technical and non-technical users.

How we built it

We built the prototype using:

• R for computation
• Shiny for interactive UI
• dplyr for data preparation
• ggplot2 for visualisation

We created simulated company data and used Shiny’s reactive framework so that every slider change updates the entire model in real time. The UI was intentionally kept simple, with tabs for losses, reserves, risk transfer, and scenario comparisons.

Challenges we ran into

No real project is smooth, and we faced several hurdles:

• Modelling cyber risk actuarially: Cyber losses don’t follow neat patterns like mortality or claims data.
• Building reactive logic: Understanding how Shiny updates values dynamically took time.
• Making visuals meaningful: We wanted graphs that explained the story, not just decorated it.
• Finding the right level of complexity: Too complex made it confusing; too simple made it unrealistic.

Every challenge sharpened our understanding of both actuarial modelling and interactive tool design.

Accomplishments that we're proud of

• Turning a real cyber incident into a working actuarial model.
• Building a fully interactive dashboard from scratch.
• Making complex topics—like reserving and reinsurance—easy to visualise.
• Designing something practical enough that an insurer could actually use it.

We’re proud that our tool brings actuarial science and cyber risk together in a meaningful, useful way.

What we learned

This project taught us how broad actuarial science can be. We learned:

• how to quantify uncertain, irregular risks like cyberattacks
• how to apply formulas and stress testing to non-traditional insurance problems
• how to use Shiny to build real-time decision support tools
• how to communicate risk visually and clearly

Most importantly, we learned how actuaries can contribute to cybersecurity and data protection.

What's next for *Actuarial Insights into Cyber Attack Trends*

We plan to extend the project in several directions:

• Integrating real insurer data instead of simulated numbers
• Adding machine learning models to estimate breach probability
• Expanding the model to include cloud outages and vendor failures
• Improving the UI for industry-level use
• Scaling the dashboard for banks, fintechs, and global insurers

Our long-term vision is simple: to make cyber risk modelling as dynamic, data-driven, and transparent as possible, so insurers can stay resilient in a world of evolving threats.

Built With

• r