  The interconnectivity of cyber and physical systems and Internet of things
has created ubiquitous concerns of cyber threats for enterprise system
managers. It is common that the asset owners and enterprise network operators
need to work with cybersecurity professionals to manage the risk by
remunerating them for their efforts that are not directly observable. In this
paper, we use a principal-agent framework to capture the service relationships
between the two parties, i.e., the asset owner (principal) and the cyber risk
manager (agent). Specifically, we consider a dynamic systemic risk management
problem with asymmetric information where the principal can only observe cyber
risk outcomes of the enterprise network rather than directly the efforts that
the manager expends on protecting the resources. Under this information
pattern, the principal aims to minimize the systemic cyber risks by designing a
dynamic contract that specifies the compensation flows and the anticipated
efforts of the manager by taking into account his incentives and rational
behaviors. We formulate a bi-level mechanism design problem for dynamic
contract design within the framework of a class of stochastic differential
games. We show that the principal has rational controllability of the systemic
risk by designing an incentive compatible estimator of the agent's hidden
efforts. We characterize the optimal solution by reformulating the problem as a
stochastic optimal control program which can be solved using dynamic
programming. We further investigate a benchmark scenario with complete
information and identify conditions that yield zero information rent and lead
to a new certainty equivalence principle for principal-agent problems. Finally,
case studies over networked systems are carried out to illustrate the
theoretical results obtained.
