  With the growing digital transformation of the worldwide economy, cyber risk
has become a major issue. As 1 % of the world's GDP (around $1,000 billion) is
allegedly lost to cybercrime every year, IT systems continue to get
increasingly interconnected, making them vulnerable to accumulation phenomena
that undermine the pooling mechanism of insurance. As highlighted in the
literature, Hawkes processes appear to be suitable models to capture contagion
phenomena and clustering features of cyber events. This paper extends the
standard Hawkes modeling of cyber risk frequency by adding external shocks,
modelled by the publication of cyber vulnerabilities that are deemed to
increase the likelihood of attacks in the short term. The aim of the proposed
model is to provide a better quantification of contagion effects since, while
the standard Hawkes model allocates all the clustering phenomena to
self-excitation, our model allows to capture the external common factors that
may explain part of the systemic pattern. We propose a Hawkes model with two
kernels, one for the endogenous factor (the contagion from other cyber events)
and one for the exogenous component (cyber vulnerability publications). We use
parametric exponential specifications for both the internal and exogenous
intensity kernels, and we compare different methods to tackle the inference
problem based on public datasets containing features of cyber attacks found in
the Hackmageddon database and cyber vulnerabilities from the Known Exploited
Vulnerability database and the National Vulnerability Dataset. By refining the
external excitation database selection, the degree of endogeneity of the model
is nearly halved. We illustrate our model with simulations and discuss the
impact of taking into account the external factor driven by vulnerabilities.
Once an attack has occurred, response measures are implemented to limit the
effects of an attack. These measures include patching vulnerabilities and
reducing the attack's contagion. We use an augmented version of the model by
adding a second phase modeling a reduction in the contagion pattern from the
remediation measures. Based on this model, we explore various scenarios and
quantify the effect of mitigation measures of an insurance company that aims to
mitigate the effects of a cyber pandemic in its insured portfolio.
