Understanding Cyber-risk by Investigating the Behaviour of Defender and Threat Agent Organisations: Why a Complex Adaptive Systems Perspective Contributes to Further Understanding Cyber-risk

Cyber-attacks have become inevitable in modern day society. Therefore, the occurrence of cyber-attacks is increasingly seen as a risk in an organisation. This has increased the interest in risk analysis methods since these try to better understand this so-called cyber-risk. However, these methods fall short since they do not sufficiently take into account the behaviour of defender organisations, which can be public or private organisations, and the behaviour of threat agent organisations, those who perform cyber-attacks. These are important determinants of cyber-risk. In this paper, a complex adaptive systems (CAS) perspective is used for cyber-risk analysis. Performing cyber-risk analysis through this perspective creates increased understanding in the relationship between the defender and threat agent behaviour and cyber-risk. In order to generate these insights, an agent-based model (ABM) is constructed. I will show that new insights, regarding the cyber-risk that is carried by a defender organisation, are generated by this novel combination of cyber-risk and CAS. The novelty of these insights must encourage scholars in the field of cyber-risk to embrace the CAS-perspective in cyber-risk analysis so that the understanding of cyber-risk can be further increased.