ETD

• insurance

Can a risk that learns, adapts, and changes faster than the data describing it, be treated as a catastrophe and sold to the capital markets? The prevailing answer is no: cyber risk is endogenous where natural perils are exogenous, non-stationary where they are stable, and opaque where they are modelled with confidence, and these differences have been read as disqualifications. This thesis argues the opposite. The properties that exclude cyber from the catastrophe-bond template are precisely the properties a better instrument can exploit.
To answer it concretely, the thesis designs, simulates, and prices a cyber catastrophe bond, Galileo Re, that turns cyber's three supposed disqualifications into instruments. Where the peril's endogeneity was thought to defeat risk transfer, a resilience covenant makes the bond act on the hazard, and earn a lower spread for doing so, without breaking incentives. Where the choice of trigger was a matter of taste, it becomes a theorem: a hybrid duration and footprint trigger is proven to carry less basis risk. Where the peril seemed too formless to define, an independent determination agent pins it down. And the market's large ``novelty premium'', long written off as unfamiliarity, proves to be something different: an ambiguity premium, the rational price of not knowing the loss distribution, and one the covenant is built to shrink. What disqualified cyber from the old design, this thesis argues, qualifies it for the new one.