Selection and Screening in Cyber Insurance Markets

This paper examines the interaction between demand-side selection and supplyside screening in the U.S. cyber insurance market, leveraging novel data from a major insurance broker. I document two stages of selection: firms with higher cyber risk are more likely to both engage a broker and to purchase insurance. Insurers primarily manage risk by capping coverage rather than differentiating prices, and they use survey-based screening that is only weakly correlated with underlying risk. This shifts risk management from price to quantity and constrains aggregate market capacity. Market-level evidence from a tax reform using a difference-indifferences approach supports the presence of adverse selection. A theoretical framework with asymmetric information, financial frictions, and market power rationalizes these findings.