The Benefits and Costs of Cybersecurity Risk Reduction: A Dynamic Extension of the Gordon and Loeb Model

Abstract

This article develops a dynamic extension of the classic model of cybersecurity investment formulated by Gordon and Loeb. In this dynamic model, results are influenced by the rate at which cybersecurity assets depreciate and the rate of return on investment. Depreciation costs are lower in the dynamic model than is implicitly assumed in the classic model, while the rate-of-return threshold is higher. On balance, the user cost of cybersecurity assets is lower in the dynamic model than is implicitly assumed in the classic model. This difference increases the economically efficient size of the cybersecurity system in value terms, increasing the efficient level of risk reduction