A RISK-AWARE ECONOMIC FRAMEWORK FOR CYBERSECURITY SYSTEMS

This thesis investigates the problem of determining an economically justified level of cybersecurity investment. The analysis starts from the Gordon--Loeb model, which represents one of the main theoretical benchmarks in cybersecurity economics, and examines its dependence on expected loss as the central driver of the investment decision. This dependence becomes critical when cyber losses are interpreted as stochastic and potentially heavy-tailed variables, since the expected value may be unstable, poorly representative of tail exposure, or theoretically undefined. To address this limitation, the thesis proposes a new economic framework based on an investment-efficiency index. The framework evaluates the expected reduction in cyber loss relative to both the investment cost and an exogenous monetary exposure threshold, which represents the maximum loss scale tolerated by the firm. The proposed model is applied to the two classical Gordon--Loeb breach probability classes. For the first class, the optimality condition leads to an algebraic equation. For the second class, the solution is obtained through the Lambert function. A numerical analysis based on calibrated parameter values from the literature is then conducted to study the behaviour of the optimal investment under different productivity parameters and threshold scenarios. A numerical analysis based on calibrated parameter values from the literature is then conducted to study the behaviour of the optimal investment under different productivity parameters and threshold scenarios. Within the parameter configurations considered, the results show that the framework provides a tractable and risk-aware tool for analysing cybersecurity investment decisions under cyber loss uncertainty.

This thesis investigates the problem of determining an economically justified level of cybersecurity investment. The analysis starts from the Gordon--Loeb model, which represents one of the main theoretical benchmarks in cybersecurity economics, and examines its dependence on expected loss as the central driver of the investment decision. This dependence becomes critical when cyber losses are interpreted as stochastic and potentially heavy-tailed variables, since the expected value may be unstable, poorly representative of tail exposure, or theoretically undefined. To address this limitation, the thesis proposes a new economic framework based on an investment-efficiency index. The framework evaluates the expected reduction in cyber loss relative to both the investment cost and an exogenous monetary exposure threshold, which represents the maximum loss scale tolerated by the firm. The proposed model is applied to the two classical Gordon--Loeb breach probability classes. For the first class, the optimality condition leads to an algebraic equation. For the second class, the solution is obtained through the Lambert function. A numerical analysis based on calibrated parameter values from the literature is then conducted to study the behaviour of the optimal investment under different productivity parameters and threshold scenarios. Within the parameter configurations considered, the results show that the framework provides a tractable and risk-aware tool for analysing cybersecurity investment decisions under cyber loss uncertainty.