This research addresses two key problems in the cyber insurance industry – reporting delays and under-reporting of cyber incidents. Both problems are important to understand the true picture of cyber incident rates. While reporting delays addresses the problem of delays in reporting due to delays in timely detection, under-reporting addresses the problem of cyber incidents frequently under-reported due to brand damage, reputation risk and eventual financial impacts.
The problem of reporting delays in cyber incidents is resolved by generating the distribution of reporting delays and fitting modeled parametric distributions on the given domain. The reporting delay distribution was found to be non-stationary and bimodal. While non-stationarity was handled by generating the monthly reporting delay distribution over the rolling two-year moving window, the bimodal aspect required an optimization algorithm to compute the parameters. The modeled parametric distribution is further extended to infinite domain to obtain the complete overview of the incidents occurred but not yet reported. The complete modeled parametric distribution provides the correction factors showing an increasing trend in recent months rather than a decline as observed from reported incidents. The correction of reporting delays is computed for the US market. The study is further extended to highlight how reporting delays vary from industry to industry. Four different industries of US companies were compared within US market: Finance and Insurance, Educational Services, Health Care and Social Assistance, and Public Administration. The comparative study showed the corrections for reporting delays in the overall US market and by industry, with specific emphasis on the four distinct industries.
The problem of under-reporting in cyber incidents is addressed in context of population characteristics. The proposed solution computes the large variations in under-reporting as a function of the three variables - revenue, incident type, and industry. Three different incident types–hacking, social engineering, and ransomware-- and five industries– Retail Trade, Manufacturing, Finance and Insurance, Professional Scientific Technical Services, and Wholesale Trade– were studied. The research highlighted that there is a need to address under-reporting by incident types and by industry.
","abstract_html":"<p>This research addresses two key problems in the cyber insurance industry – reporting delays and under-reporting of cyber incidents. Both problems are important to understand the true picture of cyber incident rates. While reporting delays addresses the problem of delays in reporting due to delays in timely detection, under-reporting addresses the problem of cyber incidents frequently under-reported due to brand damage, reputation risk and eventual financial impacts.</p> <p>The problem of reporting delays in cyber incidents is resolved by generating the distribution of reporting delays and fitting modeled parametric distributions on the given domain. The reporting delay distribution was found to be non-stationary and bimodal. While non-stationarity was handled by generating the monthly reporting delay distribution over the rolling two-year moving window, the bimodal aspect required an optimization algorithm to compute the parameters. The modeled parametric distribution is further extended to infinite domain to obtain the complete overview of the incidents occurred but not yet reported. The complete modeled parametric distribution provides the correction factors showing an increasing trend in recent months rather than a decline as observed from reported incidents. The correction of reporting delays is computed for the US market. The study is further extended to highlight how reporting delays vary from industry to industry. Four different industries of US companies were compared within US market: Finance and Insurance, Educational Services, Health Care and Social Assistance, and Public Administration. The comparative study showed the corrections for reporting delays in the overall US market and by industry, with specific emphasis on the four distinct industries.</p> <p>The problem of under-reporting in cyber incidents is addressed in context of population characteristics. The proposed solution computes the large variations in under-reporting as a function of the three variables - revenue, incident type, and industry. Three different incident types–hacking, social engineering, and ransomware-- and five industries– Retail Trade, Manufacturing, Finance and Insurance, Professional Scientific Technical Services, and Wholesale Trade– were studied. The research highlighted that there is a need to address under-reporting by incident types and by industry.</p>","abstract_has_math":false,"creators":["Sangari, Seema"],"institution":null,"degree_name":"Doctor of Philosophy in Analytic and Data Science","degree_level":"Dissertation","degree_discipline":"Statistics and Analytical Sciences","degree_department":null,"school":null,"contributors":["Dr. Michael Whitman","Dr. Eric Dallal","Dr. Jennifer Priestley","Dr. Xinyan Zhang"],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2022,"date_issued":"2022-08-04T07:00:00Z","date_published":"2022-08-04T07:00:00Z","updated_at":"2026-07-24T02:43:58Z","subjects":["Cyber Insurance","Cyber Risk","Debiased Delay Distribution","Mixed Distribution","Modeled Distribution","Optimization","Reporting Delays","Truncated Distribution","Under-reporting","Applied Mathematics","Data Science","Statistics and Probability"],"languages":[],"rights":[],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"https://digitalcommons.kennesaw.edu/dataphd_etd/13","outbound_label":"Repository record","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor","label":"Contributor","values":["Dr. Michael Whitman","Dr. Eric Dallal","Dr. Jennifer Priestley","Dr. Xinyan Zhang"]},{"key":"dc:creator","label":"Author","values":["Sangari, Seema"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.available","label":"Dc Date Available","values":["2022-11-12T08:00:00Z"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Statistics and Analytical Sciences"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Dissertation"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Doctor of Philosophy in Analytic and Data Science"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Cyber Insurance","Cyber Risk","Debiased Delay Distribution","Mixed Distribution","Modeled Distribution","Optimization","Reporting Delays","Truncated Distribution","Under-reporting","Applied Mathematics","Data Science","Statistics and Probability"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["https://digitalcommons.kennesaw.edu/dataphd_etd/13"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["This research addresses two key problems in the cyber insurance industry – reporting delays and under-reporting of cyber incidents. Both problems are important to understand the true picture of cyber incident rates. While reporting delays addresses the problem of delays in reporting due to delays in timely detection, under-reporting addresses the problem of cyber incidents frequently under-reported due to brand damage, reputation risk and eventual financial impacts.
The problem of reporting delays in cyber incidents is resolved by generating the distribution of reporting delays and fitting modeled parametric distributions on the given domain. The reporting delay distribution was found to be non-stationary and bimodal. While non-stationarity was handled by generating the monthly reporting delay distribution over the rolling two-year moving window, the bimodal aspect required an optimization algorithm to compute the parameters. The modeled parametric distribution is further extended to infinite domain to obtain the complete overview of the incidents occurred but not yet reported. The complete modeled parametric distribution provides the correction factors showing an increasing trend in recent months rather than a decline as observed from reported incidents. The correction of reporting delays is computed for the US market. The study is further extended to highlight how reporting delays vary from industry to industry. Four different industries of US companies were compared within US market: Finance and Insurance, Educational Services, Health Care and Social Assistance, and Public Administration. The comparative study showed the corrections for reporting delays in the overall US market and by industry, with specific emphasis on the four distinct industries.
The problem of under-reporting in cyber incidents is addressed in context of population characteristics. The proposed solution computes the large variations in under-reporting as a function of the three variables - revenue, incident type, and industry. Three different incident types–hacking, social engineering, and ransomware-- and five industries– Retail Trade, Manufacturing, Finance and Insurance, Professional Scientific Technical Services, and Wholesale Trade– were studied. The research highlighted that there is a need to address under-reporting by incident types and by industry.
"]},{"key":"dc:title","label":"Title","values":["Debiasing Cyber Incidents – Correcting for Reporting Delays and Under-reporting"]}]}],"canonical_facts":{"dc:contributor":["Dr. Michael Whitman","Dr. Eric Dallal","Dr. Jennifer Priestley","Dr. Xinyan Zhang"],"dc:creator":["Sangari, Seema"],"dc:date.available":["2022-11-12T08:00:00Z"],"dc:description.abstract":["This research addresses two key problems in the cyber insurance industry – reporting delays and under-reporting of cyber incidents. Both problems are important to understand the true picture of cyber incident rates. While reporting delays addresses the problem of delays in reporting due to delays in timely detection, under-reporting addresses the problem of cyber incidents frequently under-reported due to brand damage, reputation risk and eventual financial impacts.
The problem of reporting delays in cyber incidents is resolved by generating the distribution of reporting delays and fitting modeled parametric distributions on the given domain. The reporting delay distribution was found to be non-stationary and bimodal. While non-stationarity was handled by generating the monthly reporting delay distribution over the rolling two-year moving window, the bimodal aspect required an optimization algorithm to compute the parameters. The modeled parametric distribution is further extended to infinite domain to obtain the complete overview of the incidents occurred but not yet reported. The complete modeled parametric distribution provides the correction factors showing an increasing trend in recent months rather than a decline as observed from reported incidents. The correction of reporting delays is computed for the US market. The study is further extended to highlight how reporting delays vary from industry to industry. Four different industries of US companies were compared within US market: Finance and Insurance, Educational Services, Health Care and Social Assistance, and Public Administration. The comparative study showed the corrections for reporting delays in the overall US market and by industry, with specific emphasis on the four distinct industries.
The problem of under-reporting in cyber incidents is addressed in context of population characteristics. The proposed solution computes the large variations in under-reporting as a function of the three variables - revenue, incident type, and industry. Three different incident types–hacking, social engineering, and ransomware-- and five industries– Retail Trade, Manufacturing, Finance and Insurance, Professional Scientific Technical Services, and Wholesale Trade– were studied. The research highlighted that there is a need to address under-reporting by incident types and by industry.
"],"dc:identifier":["https://digitalcommons.kennesaw.edu/dataphd_etd/13"],"dc:subject":["Cyber Insurance","Cyber Risk","Debiased Delay Distribution","Mixed Distribution","Modeled Distribution","Optimization","Reporting Delays","Truncated Distribution","Under-reporting","Applied Mathematics","Data Science","Statistics and Probability"],"dc:title":["Debiasing Cyber Incidents – Correcting for Reporting Delays and Under-reporting"],"thesis:degree_discipline":["Statistics and Analytical Sciences"],"thesis:degree_level":["Dissertation"],"thesis:degree_name":["Doctor of Philosophy in Analytic and Data Science"]},"updated_at":"2026-07-24T02:43:58Z"}