Paper: arXiv 2505.01221

Authors: Giorgia Callegaro, Claudio Fontana, Caroline Hillairet, Beatrice Ongarato

Abstract

We develop a continuous-time stochastic model for optimal cybersecurity investment under the threat of cyberattacks. The arrival of attacks is modeled using a Hawkes process, capturing the empirically relevant feature of clustering in cyberattacks. Extending the Gordon-Loeb model, each attack may result in a breach, with breach probability depending on the system’s vulnerability. We aim at determining the optimal cybersecurity investment to reduce vulnerability. The problem is cast as a two-dimensional Markovian stochastic optimal control problem and solved using dynamic programming methods. Numerical results illustrate how accounting for attack clustering leads to more responsive and effective investment policies, offering significant improvements over static and Poisson-based benchmark strategies. Our findings underscore the value of incorporating realistic threat dynamics into cybersecurity risk management.

Complexity vs Empirical Score

  • Math Complexity: 8.0/10
  • Empirical Rigor: 4.5/10
  • Quadrant: Lab Rats — theoretically deep, empirically untested

Why this score: The paper provides a strong theoretical contribution by extending the static Gordon-Loeb model into a dynamic, continuous-time stochastic optimal control problem using Hawkes processes. While it includes numerical simulations based on realistic literature parameters, it lacks empirical backtesting on real-world transaction or breach datasets.

Research Flowchart

  flowchart TD
    A[Research Goal: Optimal Cybersecurity Investment under Clustered Attacks] --> B[Model Inputs: Vulnerability Functions & Cyberattack Data]
    B --> C[Methodology: Hawkes Process for Attack Clustering + Gordon-Loeb Framework]
    C --> D[Formulate 2D Markovian Stochastic Optimal Control Problem]
    D --> E[Computational Process: Solve Hamilton-Jacobi-Bellman via Dynamic Programming]
    E --> F[Key Outcomes: Dynamic Investment Strategy Outperforms Static & Poisson Benchmarks]

Cited References (86)

  1. Extensions of the deep G alerkin method (2022)
  2. Maximum likelihood estimation of H awkes’ self-exciting point processes (1979)
  3. Cyber Readiness Report 2024
  4. Explicit correlations for the H awkes processes (2025)
  5. Probability and Measure (1986)
  6. A risk-sharing mechanism for multi-region catastrophe insurance with government subsidies (2023)
  7. Cyber Risk: quantification, stress scenarios, mitigation, and insurance (2025)
  8. Risk mitigation services in cyber insurance: optimal contract design and price structure (2023)
and 78 more
  1. Risk theory (2017)
  2. Modeling cyber-insurance: towards a unifying framework (2010)
  3. Economic incentives to increase security in the internet: the case for insurance (2009)
  4. Optimal self-protection via BSDEs for risk models with jump clusters (2025)
  5. Agency Problems and Adversarial Bilevel Optimization under Uncertainty and Cyber Threats (2025)
  6. Internalizing externalities of loss prevention through insurance monopoly: an analysis of interdependent risks (2007)
  7. Contagion in cyber security attacks (2017)
  8. Piecewise-deterministic M arkov processes: a general class of non-diffusion stochastic models (1984)
  9. Continuous-time Stochastic Control and Optimization with Financial Applications (2009)
  10. A continuous-time model of self-protection (2023)
  11. Hawkes Processes in Finance (2015)
  12. Multivariate H awkes processes with simultaneous occurrence of excitation events coming from different sources (2023)
  13. Multivariate H awkes processes: an Application to financial data (2011)
  14. Construction and Simulation of Generalized Multivariate H awkes Processes (2022)
  15. A multivariate model to quantify and mitigate cybersecurity risk (2020)
  16. A cluster process representation of a self-exciting process (1974)
  17. Hawkes Processes Modeling, Inference, and Control: an Overview (2023)
  18. Clustering effects via H awkes processes (2020)
  19. Multivariate H awkes process for cyber insurance (2021)
  20. Cyber risk modeling using a two-phase H awkes process with external excitation (2023) — link
  21. Point Processes and Queues: Martingale Dynamics (1981)
  22. Exact simulation of H awkes process with exponentially decaying intensity (2013)
  23. A dynamic contagion process (2011)
  24. Introduction to stochastic control of mixed diffusion processes, viscosity solutions, and applications in finance and insurance (2007)
  25. The economics of information security investment (2002)
  26. The barriers to sustainable risk transfer in the cyber-insurance market (2024)
  27. Integrating cost–benefit analysis into the NIST cybersecurity framework via the G ordon– L oeb model (2020)
  28. Cyber security: small firms under fire (2013)
  29. Economics of information security investment in the case of concurrent heterogeneous attacks with budget constraints (2013)
  30. Cybersecurity Investment Guidance: Extensions of the G ordon and L oeb Model (2016)
  31. Externalities and the Magnitude of Cyber Security Underinvestment by Private Sector Firms: A Modification of the G ordon- L oeb Model (2015)
  32. Modeling and management of cyber risk: a cross-disciplinary review (2024)
  33. A review on Poisson, Cox, Hawkes, shot-noise Poisson and dynamic contagion process and their compound processes (2021)
  34. Robustness of optimal investment decisions in mixed insurance/investment cyber risk management (2020)
  35. Enterprise security economics: a self-defense versus cyber-insurance dilemma (2019)
  36. Calibration of the G ordon– L oeb Models for the Probability of Security Breaches (2017)
  37. Expanding the G ordon- L oeb model to cyber-insurance (2022)
  38. Risk processes with non-stationary Hawkes claims arrivals (2010)
  39. Optimal timing of information security investment: a real options approach (2010)
  40. A framework for incorporating insurance in critical infrastructure cyber risk strategies (2016)
  41. Some Generalizations of the Theory of Cumulative Sums of Random Variables (1945)
  42. ODE -oriented semi-analytical methods (1999)
  43. Solving Ordinary Differential Equations II : Stiff and Differential-Algebraic Problems (1993)
  44. Spectra of some self-exciting and mutually exciting point processes (1971)
  45. The elements of Hawkes processes (2021)
  46. An insurance theory based optimal cyber-insurance contract against moral hazard (2020)
  47. A comprehensive model for cyber risk based on marked point processes and its application to insurance (2022)
  48. ENISA Threat Landscape 2024 Report (2024)
  49. 2025 ICS/OT Cybersecurity Budget: Spending Trends, Challenges, and the Future (2025)
  50. Is accumulation risk in cyber methodically underestimated? (2024)
  51. Modeling and pricing cyber insurance: idiosyncratic, systematic, and systemic risks (2023)
  52. Mathematical Models for New Types of Cyberattack and Associated Defence Strategies (2024)
  53. On the mathematical theory of risk (1930)
  54. Approximerad Framställning af Sannolikhetsfunktionen: Återförsäkring af Kollektivrisker (1903)
  55. Försäkringsteknisk Riskutjämning: Teori (1926)
  56. On a formula concerning stochastic differentials (1951)
  57. Stochastic control for diffusions with self-exciting jumps: an overview (2024)
  58. A comparison theorem for semimartingales and its applications (2006)
  59. Insuring against cyber-attacks (2017)
  60. A finite difference scheme for option pricing in jump diffusion and exponential L 'e vy models (2005)
  61. Optimal Harvesting Under Uncertain Environment with Clusters of Catastrophes (2025)
  62. Modelling health-data breaches with application to cyber insurance (2023)
  63. The benefits and costs of cybersecurity risk reduction: a dynamic extension of the G ordon and L oeb model (2021)
  64. How Fast Does Malware Leveraging EternalBlue Propagate? The case of WannaCry and NotPetya (2024)
  65. At the cybersecurity frontier: key strategies and persistent challenges for lusiness Leaders (2025)
  66. Cyber risk research in business and actuarial science (2020)
  67. Non-Life Insurance Mathematics: An Introduction with the Poisson Process (2009)
  68. The Elements of Hawkes Processes (2021)
  69. Information security expenditures and real options: a wait-and-see approach (2003)
  70. Cyber security risk management: public policy implications of correlated risk, imperfect ability to prove loss, and observability of self-protection (2011)
  71. Dangerous games: a literature review on cybersecurity investments (2022)
  72. An Overview of Security Breach Probability Models (2022)
  73. AON 10th Global Risk Management Survey (2025)
  74. Top 10 Operational Risks for 2025 (2025)
  75. Cost of a Data Breach Report 2025 (2025)
  76. An elementary derivation of moments of Hawkes processes (2020)
  77. Multivariate self-exciting processes with dependencies — → 2503.15958
  78. Hawkes and Affine Processes in Risk Modeling: Theory and Applications in Finance and Cybersecurity (2026)

1 of 86 cited works are in the corpus; resolved via arXiv source bundles, Semantic Scholar and OpenAlex. Corpus-wide: 2518 linked papers.