Abstract

This study investigates whether cyber loss events occurring in the United States are spatially correlated and if so, which socioeconomic factors are associated with the spatial correlation. We analyze 3132 counties of the 50 U.S. states from 2005 to 2020 using the largest existing dataset of cyber risks and socioeconomic data. While previous literature found no or little spatial correlation at the state level, we are the first to document that such correlation exists at the county level; positive Moran’s I indicates that more exposed (i.e., a relatively large number of cyber events and losses) and less exposed counties are clustered. Spatial regressions show positive direct and negative indirect effects of county-level population and average income on loss frequency and severity. Large and wealthy counties thus tend to be more exposed to cyber risk events, but their geographically neighboring counties are less affected. We further investigate relatively exposed regions (California and the Northeast Coast) and three risk types (malicious, unintended, and privacy risks) and show consistent spatial effects for the key variables of population size and average income. Our findings can aid risk managers, cyber insurers, and policymakers to geographically differentiate cyber risk, recognize relatively more exposed regions, and develop more effective risk management strategies.

https://doi.org/10.1080/10920277.2024.2408263