This study introduces an explainable Artificial Intelligence (XAI) framework that couples legal-domain NLP with Structural Topic Modeling (STM) and WordNet semantic graphs to rigorously analyze over 1,900 GDPR enforcement decision summaries from a public dataset. Our methodology focuses on demonstrating the pipeline's validity respect to manual analyses by inspecting the results of four well-know research questions: (1) cross-country fine distribution disparities (automated metadata extraction); (2) the violation severity-fine amount relationship (keyness and semantic analysis); (3) structural text patterns (network analysis and STM); and (4) prevalent enforcement triggers (topic prevalence modeling) The pipeline's validity is underscored by its ability to replicate key findings from previous manual analyses while enabling a more nuanced exploration of GDPR enforcement trends. Our results confirm significant disparities in enforcement across EU member states and reveal that monetary penalties do not consistently correlate with violation severity. Specifically, serious infringements, particularly those involving video surveillance, frequently result in low-value fines, especially when committed by individuals or smaller entities. This highlights that a substantial proportion of severe violations are attributed to smaller actors. Methodologically, the framework's ability to quickly replicate such well-known patterns, alongside its transparency and reproducibility, establishes its potential as a scalable tool for transparent and explainable GDPR enforcement analytics.

Increasing use of new digital services offers tremendous opportunities for modern society, but also entails new risks. One tool for managing cyber risk is cyber insurance. While cyber insurance has attracted much attention and optimism, interdependent cyber risks and lack of actuarial data have prompted some insurers to adopt a more proactive role, not only insuring losses but also assisting clients with preventive work such as managed detection and response solutions, i.e., investments in their own cybersecurity. The purpose of this paper is to propose and theoretically investigate yet a further extension of this role, where insurers facilitate security investments between interdependent firms, which get the opportunity to invest a share of their insurance premiums to improve the security of each other. It is demonstrated that if insurers can facilitate such investments, then under common theoretical assumptions this can make a positive contribution to overall welfare. The paper is concluded by a discussion of the relevance and applicability of this theoretical contribution in practice.

Cyber insurance is a crucial tool for managing risks associated with cyber threats. A challenging task for insurance companies lies in pricing cyber risk. Our study is motivated by the reasonable assumption that firms entering into cyber insurance contracts face diverse cyber threats in terms of types and magnitude. Considering these differences ensures that premiums align with the actual risk exposure of the insured. The study discusses this approach proposing a case study based on the Chronology of Data Breaches provided by the Privacy Rights Clearinghouse.

Modern ICT infrastructures, i.e., cyber-physical systems and critical infrastructures relying on interconnected IT (Information Technology)- and OT (Operational Technology)-based components and (sub-)systems, raise complex challenges in tackling security and safety issues. Nowadays, many security controls and mechanisms have been made available and exploitable to solve specific security needs, but, when dealing with very complex and multifaceted heterogeneous systems, a methodology is needed on top of the selection of each security control that will allow the designer/maintainer to drive her/his choices to build and keep the system secure as a whole, leaving the choice of the security controls to the last step of the system design/development. This paper aims at providing a comprehensive methodological approach to design and preliminarily implement an Open Platform Architecture (OPA) to secure the cyber-physical systems of critical infrastructures. Here, the Open Platform Architecture (OPA) depicts how an already existing or under-design target system (TS) can be equipped with technologies that are modern or currently under development, to monitor and timely detect possibly dangerous situations and to react in an automatic way by putting in place suitable countermeasures. A multifaceted use case (UC) that is able to show the OPA, starting from the security and safety requirements to the fully designed system, will be developed step by step to show the feasibility and the effectiveness of the proposed methodology.

Cyber risk is a significant concern for all types of businesses. The consequences of a cyber attack can be quite severe. Investing in security to mitigate the impact of such risks is a crucial task, both in terms of the frequency and the severity of cyber incidents. In this paper, we propose a practical application of the Gordon and Loeb model, thereby suggesting a methodology to estimate risk exposure and reconsidering some investment evaluation metrics. Our findings strongly support the claim that maximizing the expected net benefit of an investment solely at the optimal level is not sufficient for sound decision-making. On the contrary, incorporating metrics that evaluate the benefit in relation to risk and consider worst-case scenarios offers deeper insights

The REDRAW project investigates the exploitation of the federated learning computing paradigm to improve the technologies adopted for the monitoring, diagnosis and treatment management of specific health conditions, developing approaches more respectful of the constraints of privacy, confidentiality and cybersecurity, which are still largely absent from the market. REDRAW proposes the study and fine-tuning of dynamic cloud-edge deployment techniques, which exploits Federated Learning (FL) models, in three real-world contexts, to improve the technological features of existing solutions, while respecting the strategic and non-functional constraints that characterize the Italian and European scenarios .

Mortality shocks, such as pandemics, threaten the consolidated longevity improvements, confirmed in the last decades for the majority of western countries. Indeed, just before the COVID-19 pandemic, mortality was falling for all ages, with a different behavior according to different ages and countries. It is indubitable that the changes in the population longevity induced by shock events, even transitory ones, affecting demographic projections, have financial implications in public spending as well as in pension plans and life insurance. The Short Term Mortality Fluctuations (STMF) data series, providing data of all-cause mortality fluctuations by week within each calendar year for 38 countries worldwide, offers a powerful tool to timely analyze the effects of the mortality shock caused by the COVID-19 pandemic on Italian mortality rates. This dataset, recently made available as a new component of the Human Mortality Database, is described and techniques for the integration of its data with the historical mortality time series are proposed. Then, to forecast mortality rates, the well-known stochastic mortality model proposed by Lee and Carter in 1992 is first considered, to be consistent with the internal processing of the Human Mortality Database, where exposures are estimated by the Lee-Carter model; empirical results are discussed both on the estimation of the model coefficients and on the forecast of the mortality rates. In detail, we show how the integration of the yearly aggregated STMF data in the HMD database allows the Lee-Carter model to capture the complex evolution of the Italian mortality rates, including the higher lethality for males and older people, in the years that follow a large shock event such as the COVID-19 pandemic. Finally, we discuss some key points concerning the improvement of existing models to take into account mortality shocks and evaluate their impact on future mortality dynamics.

Digitization offers great opportunities as well as new challenges. Indeed, these opportunities entail increased cyber risks, both from deliberate cyberattacks and from incidents caused by inadvertent human error. Cyber risk must be mastered, and to this aim, its quantification is an urgent challenge. There is a lot of interest in this topic from the insurance community in order to price adequate coverage to their customers. A key first step is to investigate the frequency and severity of cyber incidents. On the grounds that data breaches seem to be the main cause of cyber incidents, the aim of this paper is to give further insights about the frequency and severity statistical distributions of malicious and negligent data breaches. For this purpose, we refer to a publicly available dataset: the Chronology of Data Breaches provided by the Privacy Rights Clearinghouse.

The aim of this paper is to deepen the application of value at risk in the cyber domain, with particular attention to its potential role in security investment valuation. Cyber risk is a fundamental component of the overall risk faced by any organization. In order to plan the size of security investments and to estimate the consequent risk reduction, managers strongly need to quantify it. Accordingly, they can decide about the possibility of sharing residual risk with a third party, such as an insurance company. Recently, cyber risk management techniques are including some risk quantile-based measures that are widely employed in the financial domain. They refer to value at risk that, in the cyber context, takes the name of cyber value at risk (Cy-VaR). In this paper, the main features and challenging issues of Cy-VaR are examined. The possible use of this risk measure in supporting investment decisions in cyber context is discussed, and new risk-based security metrics are proposed. Some simple examples are given to show their potential.

The Internet evolution is one of the greatest innovations of the twentieth century and has changed lives of individuals and business organizations. On the other hand, potential attacks on the information systems and eventual crash may cause heavy losses on data, services and business operation. Executives and security professionals are accepting that it is not a matter of if but a matter of when their organization will be hit by a cyber-attack. As a consequence, cyber risk is a fast-growing area of concern. Companies have to include cyber risk in their risk management framework, depicting their risk profile, assessing their risk appetite and looking for corresponding risk transfer solutions. Measures and methods used in financial sector to quantify risk, have been recently applied to cyber world. The aim is to help organizations to improve risk management strategies and to make better decisions about investments in cyber security. On the other hand, they are useful instruments for insurance companies in pricing cyber insurance contracts and setting the minimum capital requirements defined by the regulators. Aim of this contribution, is to offer a review of the recent literature on cyber risk management deepening economic issues and their interplay with technical ones, from both internal (organization) and external (systemic) perspectives.

Despite the development of new technologies in order to prevent the stealing of cars, the number of car thefts is sharply increasing. With the advent of electronics, new ways to steal cars were found. In order to avoid auto-theft attacks, in this paper we propose a machine learning based method to silently and continuously profile the driver by analyzing built-in vehicle sensors. We consider a dataset composed by 51 different features extracted by 10 different drivers, evaluating the efficiency of the proposed method in driver identification. We also find the most relevant features able to discriminate the car owner by an impostor. We obtain a precision and a recall equal to 99% evaluating a dataset containing data extracted from real vehicle.

The reverse mortgage market has been expanding rapidly in developed economies in recent years. Reverse mortgages provide an alternative source of funding for retirement income and health care costs. Increase in life expectancies and decrease in the real income at retirement continue to worry those who are retired or close to retirement. Therefore, financial products that help to alleviate the "risk of living longer" continue to be attractive among the retirees. Reverse mortgage contracts involve a range of risks from the insurer's perspective. When the outstanding balance exceeds the housing value before the loan is settled, the insurer suffers an exposure to crossover risk induced by three risk factors: interest rates, house prices and mortality rates. We analyse the combined impact of these risks on pricing and the risk profile of reverse mortgage loans in a stochastic interest-mortality-house pricing model. Our results show that pricing of reverse mortgages loans does not accurately assess the risks underwritten by reverse mortgages lenders.In particular, it fails to take into account mortality improvements substantially underestimating the longevity risk involved in reverse mortgage loans.

Process mining is the set of techniques to retrieve a process model starting from available logging data. The discovered process model has to be analyzed to verify whether it respects the defined properties, i.e., the so-called compliance checking. Our aim is to use a model checking based approach to verify compliance. First, we propose an integrated-tool approach using existing tools as ProM (a framework supporting process mining techniques) and CADP (a formal verification environment). More precisely, the execution traces from a software system are extracted. Then, using the "Mine Transition System" plugin in ProM, we obtain a labelled transition system, that can be easily used to verify formal properties through CADP. However, this choice presents the "state explosion" problem, i.e., models discovered through the classical process mining techniques tend to be large and complex. In order to solve this problem, another custom-made approach is shown, which accomplishes a pre-processing on the traces to obtain abstract traces, where abstraction is based on the set of temporal logic formulae specifying the system properties. Then, from the set of abstracted traces, we discover a system described in Lotos, a process algebra specification language; in this way we do not build an operational model for the system, but we produce only a language description from which a model checking environment will automatically obtain the reduced corresponding transition system. Real systems have been used as case studies to evaluate the proposed methodologies.

Measures and methods used in financial sector to quantify risk, have been recently applied to cyber world. The aim is to help organizations to improve risk management strategies and to wisely plan investments in cyber security. On the other hand, they are useful instruments for insurance companies in pricing cyber insurance contracts and setting the minimum capital requirements defined by the regulators. In this paper we propose an estimation of Value at Risk (VaR), referred to as Cyber Value at Risk in cyber security domain, and Tail Value at risk (TVaR). The data breach information we use is obtained from the 'Chronology of data breaches' compiled by the Privacy Rights Clearinghouse.

In the last decades companies worldwide are facing a new kind of risk, namely cyber risk, that has emerged as one of the top challenges in risk management. Insurance was only recently applied to cyber world and it is increasingly becoming part of the risk management process, posing many challenges to actuaries. One of the main issues is the lack of data, in particular nancial ones. The aim of the paper is to point out the peculiarities of cyber insurance contracts with respect to the classical non life insurance ones both from the insurer and the insured's perspective. Therefore, the main actuarial principles that are fundamental to any valu- ation in cyber context are discussed. An illustrative example is proposed where the Chronology of Data Breaches provided by the Privacy Rights Clearing House is deeply analyzed. The most suitable distributions to represent the frequency and the severity of the reported cyber incidents are examined and the value at risk measure is estimated. Then, two ex- emplifying cases oer the assessment of both the premium required by the insurer and the indierence premium that the insured is willing to pay. Even though this research is still preliminary and shows some limits highlighted by the authors, it could offer useful information to better un- derstand this peculiar kind of insurance policies.

As discussed in the recent literature, several innovative car insurance concepts are proposed in order to gain advantages both for insurance companies and for drivers. In this context, the "pay-how-you-drive" paradigm is emerging, but it is not thoroughly discussed and much less implemented. In this paper, we propose an approach in order to identify the driver behavior exploring the usage of unsupervised machine learning techniques. A real-world case study is performed to evaluate the effectiveness of the proposed solution. Furthermore, we discuss how the proposed model can be adopted as risk indicator for car insurance companies.

In the last years, several safety automotive concepts have been proposed, for instance the cruise control and the automatic brakes systems. The proposed systems are able to take the control of the vehicle when a dangerous situation is detected. Less effort was produced in driver aggressiveness in order to mitigate the dangerous situation. In this paper we propose an approach in order to identify the driver aggressiveness exploring the usage of unsupervised machine learning techniques. A real world case study is performed to evaluate the effectiveness of the proposed method.

Several techniques have been developed in last years by automotive industry in order to protect drivers and car passengers. These methods, for instance the automatic brake systems and the cruise control, are able to intervene when there is a dangerous situation. With the aim to minimize these risks, in this paper we propose a method able to suggest to the driver the driving style to adopt in order to avoid dangerous situations. Our method is basically a two-level fuzzy systems: the first one is related to the driver under analysis, while the second one is a centralized server with the responsibility to send suggestions to drivers in order to prevent traffic incidents. We carried out a preliminary evaluation to demonstrate the effectiveness of the proposed method: we obtain of percentage variation ranging from 85.48% to 88.99% in the number of traffic incidents between the scenarios we considered using the proposed method and the scenario without the proposed method applied.

A specific kind of insurance that is emerging within the domain of cyber-systems is that of cyber-insurance. Cyber-insurance is the transfer of financial risk associated with network and computer incidents to a third party. Insurance companies are increasingly offering such policies, in particular in the USA, but also in Europe. The emerging trends in cyber insurance raise a number of unique challenges and force actuaries to reconsider how to think about underwriting, pricing and aggregation risk. Aim of this contribution is to offer a review of the recent literature on cyber risk management in the actuarial field. Moreover, basing on the most significant results in IT domain, we outline possible synergies between the two lines of research.

Solvency assessing is a compelling issue for the insurance industry, also in light of the current international risk-based regulations. Internal models have to take into account risk/profit indicators, in order to provide flexible tools aimed at valuing solvency. We focus on a variable annuity with an embedded option involving a participation level which depends on the period financial result. We realize a performance evaluation by means of a suitable indicator, which properly captures both financial and demographic risk drivers. In fact, in the case of life annuity business, assessing solvency has to be framed within a wide time horizon, where specific financial and demographic risks are realized. In this order of ideas, solvency indicators have to capture the amount of capital to cope with the impact of those risk sources over the considered period. The analysis is carried out in accordance with a management perspective, apt to measure the business performance, which requires a correct risk control; in particular we present a study of the dynamics of the profit realized per unit of the total financial value of the contract. On the other hand, the consumer profitability is also measured by means of an utility-equivalent fixed life annuity. Ac-cording to the insureds point of view, we measure their perception of the contract profitability within the expected utility approach.