Ordered response models for cyber risk

In the last years there have been a scholars increasing interest in cybersecurity risk measurement, data security, and privacy protection. Since quantitative loss data are rarely available, we deal with ordinal data representing experts’ evaluation of the severity of the attacks. Due to the ordinal nature of the available data, it turns natural to rely on cumulative link models that allows us to express the cumulative probabilities associated with the different severity levels as a non linear function of a suitable set of explanatory variables. We evaluate the effect of each explanatory categorical variable on the risk level using the Average Marginal Effect. We apply our model to a real data set that includes information on serious cyber attacks occurred worldwide in 2018.