The Economics of Cybersecurity Investment: Balancing Digital Risk and Business Value

Abstract

Organisations under-invest in cybersecurity when they treat it as a cost and over-invest when they
treat it as a mandate; neither view connects spending to the risk it reduces or the value it protects.
This paper applies the economics of security investment to the question of how much to spend and
where. Building on the Gordon–Loeb model, in which investment reduces the probability of breach
with diminishing returns, the paper derives the optimal investment for asset classes of differing
vulnerability and examines it in a simulation with a potential loss of 1,000 currency units and
vulnerability levels of 0.2, 0.5 and 0.8. Optimal investment rises with vulnerability, from 50 to 150
units, but as a share of expected loss it falls, from 25% to 19%, and in every case lies well below the
37% ceiling the model implies; net benefit at the optimum ranges from 50 to 450 units. Beyond the
optimum, additional spending reduces net benefit, and for low-vulnerability assets it turns negative
at modest levels. The paper extends the single-asset result to a portfolio allocation rule, incorporates
business value through the loss parameter, and discusses the practical estimation of vulnerability and
loss. It argues that cybersecurity budgets should be set by marginal risk reduction per unit of spend,
allocated across assets by vulnerability and value, and defended to the board in the language of
expected loss avoided.