Dynamic Contract Design for Systemic Cyber Risk Management of Interdependent Enterprise Networks

Juntao Chen, Quanyan Zhu, Tamer Başar

Research output: Contribution to journalArticlepeer-review


The interconnectivity of cyber and physical systems and Internet of things has created ubiquitous concerns of cyber threats for enterprise system managers. It is common that the asset owners and enterprise network operators need to work with cybersecurity professionals to manage the risk by remunerating them for their efforts that are not directly observable. In this paper, we use a principal–agent framework to capture the service relationships between the two parties, i.e., the asset owner (principal) and the cyber risk manager (agent). Specifically, we consider a dynamic systemic risk management problem with asymmetric information where the principal can only observe cyber risk outcomes of the enterprise network rather than directly the efforts that the manager expends on protecting the resources. Under this information pattern, the principal aims to minimize the systemic cyber risks by designing a dynamic contract that specifies the compensation flows and the anticipated efforts of the manager by taking into account his incentives and rational behaviors. We formulate a bi-level mechanism design problem for dynamic contract design within the framework of a class of stochastic differential games. We show that the principal has rational controllability of the systemic risk by designing an incentive compatible estimator of the agent’s hidden efforts. We characterize the optimal solution by reformulating the problem as a stochastic optimal control program which can be solved using dynamic programming. We further investigate a benchmark scenario with complete information and identify conditions that yield zero information rent and lead to a new certainty equivalence principle for principal–agent problems. Finally, case studies over networked systems are carried out to illustrate the theoretical results obtained.

Original languageEnglish (US)
Pages (from-to)294-325
Number of pages32
JournalDynamic Games and Applications
Issue number2
StatePublished - Jun 2021


  • Differential games
  • Dynamic contracts
  • Economics of cybersecurity
  • Internet of Things
  • Systemic risk

ASJC Scopus subject areas

  • Statistics and Probability
  • Economics and Econometrics
  • Computer Science Applications
  • Computer Graphics and Computer-Aided Design
  • Computational Theory and Mathematics
  • Computational Mathematics
  • Applied Mathematics


Dive into the research topics of 'Dynamic Contract Design for Systemic Cyber Risk Management of Interdependent Enterprise Networks'. Together they form a unique fingerprint.

Cite this