The Benefits and Costs of Cybersecurity Risk Reduction: A Dynamic Extension of the Gordon and Loeb Model. Issue 10 (15th February 2021)

• Record Type: Journal Article
• Authors: Krutilla, Kerry; Alexeev, Alexander; Jardine, Eric; Good, David
• Is Part Of: Risk analysis. Volume 41:Issue 10(2021)
• Page Start: 1795
• Page End: 1808
• Publication Date: 2021-02-15
• Subjects: Benefit‐cost analysis -- cybersecurity investment -- dynamic decision‐making; Technology -- Risk assessment -- Periodicals; 658.403
• DOI: 10.1111/risa.13713
• Languages: English
• ISSNs: 0272-4332

Abstract

Abstract: This article develops a dynamic extension of the classic model of cybersecurity investment formulated by Gordon and Loeb. In this dynamic model, results are influenced by the rate at which cybersecurity assets depreciate and the rate of return on investment. Depreciation costs are lower in the dynamic model than is implicitly assumed in the classic model, while the rate‐of‐return threshold is higher. On balance, the user cost of cybersecurity assets is lower in the dynamic model than is implicitly assumed in the classic model. This difference increases the economically efficient size of the cybersecurity system in value terms, increasing the efficient level of risk reduction.