Paper: arXiv 2601.16805

Authors: Elisa Botteghi, Martino S. Centonze, Davide Pastorello, Daniele Tantari

Abstract

Cyber risk has become a critical financial threat in today’s interconnected digital economy. This paper introduces a cyber-risk management framework for networked digital systems that combines the strategic behavior of players with contagion dynamics within a security game. We address the problem of optimally allocating cybersecurity resources across a network, focusing on the heterogeneous valuations of nodes by attackers and defenders, some areas may be of high interest to the attacker, while others are prioritized by the defender. We explore how this asymmetry drives attack and defense strategies and shapes the system’s overall resilience. We extend a method to determine optimal resource allocation based on simple network metrics weighted by the defender’s and attacker’s risk profiles. We further propose risk measures based on contagion paths and analyze how propagation dynamics influence optimal defense strategies. Numerical experiments explore risk versus cost efficient frontiers varying network topologies and risk profiles, revealing patterns of resource allocation and cyber deception effects. These findings provide actionable insights for designing resilient digital infrastructures and mitigating systemic cyber risk.

Complexity vs Empirical Score

  • Math Complexity: 7.5/10
  • Empirical Rigor: 4.0/10
  • Quadrant: Lab Rats — theoretically deep, empirically untested

Why this score: The paper provides a strong theoretical and mathematical foundation, combining Stackelberg security games with complex network contagion dynamics and heterogeneous valuation profiles. However, its empirical rigor is limited to numerical simulations and synthetic experiments rather than real-world financial or cyber attack empirical data backtests.

Research Flowchart

  flowchart TD
    A[Research Goal: Optimal Cyber Resource Allocation under Heterogeneous Risk & Contagion] --> B[Inputs: Network Topologies, Contagion Paths & Asymmetric Risk Profiles]
    B --> C[Methodology: Combine Security Games with Contagion Propagation Dynamics]
    C --> D[Computation: Calculate Metrics & Generate Risk vs. Cost Efficient Frontiers]
    D --> E[Outcomes: Strategy Patterns, Deception Insights & Framework for Resilient Infrastructure]

Cited References (97)

  1. Network security and contagion (2016)
  2. On the private provision of public goods on networks (2015)
  3. The economics of information security (2006)
  4. Stackelberg Security Games with Contagious Attacks on a Network: Reallocation to the Rescue (2023)
  5. Who’s who in networks. Wanted: The key player (2006)
  6. Cyber Risk Propagation on Networks (2024)
  7. Strategic interaction and networks (2014)
  8. Network games (2010)
and 89 more
  1. Network security (2011)
  2. Dividing a graph into triconnected components (1973)
  3. A course in game theory (1994)
  4. Existence and uniqueness of equilibrium points for concave n-person games (1965)
  5. Stackelberg security games: Looking beyond a decade of success (2018)
  6. Stackelberg vs. Nash in security games: interchangeability, equivalence, and uniqueness. (2010)
  7. Stackelberg vs. Nash in security games: An extended investigation of interchangeability, equivalence, and uniqueness (2011)
  8. A course in game theory (2020)
  9. Identifying influential nodes in complex contagion mechanism (2023)
  10. Multi-attribute decision making method for node importance metric in complex network (2022)
  11. Portfolio Selection, the journal of finance. 7 (1) (1952)
  12. A Stackelberg Game Model for Botnet Data Exfiltration (2017)
  13. Modelling cybersecurity strategies with game theory and cyber kill chain (2025)
  14. Cyberattacks and financial stability: Evidence from a natural experiment (2022)
  15. The propagation of cyberattacks through the financial system: Evidence from an actual event (2024)
  16. Do firms underreport information on cyber-attacks? Evidence from capital markets (2018)
  17. Quantifying the financial impact of IT security breaches (2003)
  18. An event study analysis of the economic impact of IT operational risk and its subcategories (2011)
  19. Cyberattacks and impact on bond valuation (2020)
  20. Informed trading in the options market surrounding data breaches (2023)
  21. Pirates without borders: The propagation of cyberattacks through firms’ supply chains (2023)
  22. The anatomy of cyber risk (2021)
  23. Network models of financial systemic risk: a review (2018)
  24. Contingent convertible bonds in financial networks (2023)
  25. Systemic risk and stability in financial networks (2015)
  26. Contagion in financial networks (2010)
  27. Theory of rumour spreading in complex social networks (2007)
  28. Networks (2018)
  29. Exploring complex networks (2001)
  30. Complex networks: principles, methods and applications (2017)
  31. Generalization of epidemic theory (1964)
  32. Epidemic processes in complex networks (2015)
  33. Complex networks: structure, robustness and function (2010)
  34. A review of the economic costs of cyber incidents (2024)
  35. What are the actual costs of cyber risk events? (2019)
  36. Game theory for network security (2012)
  37. A survey of game theory as applied to network security (2010)
  38. Game theory meets network security and privacy (2013)
  39. Protect: A deployed game theoretic system to protect the ports of the united states (2012)
  40. Leader-follower strategies for robotic patrolling in environments with arbitrary topologies (2009)
  41. Deployed armor protection: the application of a game theoretic model for security at the los angeles international airport (2008)
  42. When Security Games Go Green: Designing Defender Strategies to Prevent Poaching and Illegal Fishing. (2015)
  43. Green security games: Apply game theory to addressing green security challenges (2016)
  44. Defense coordination in security games: Equilibrium analysis and mechanism design (2022)
  45. Security and game theory: algorithms, deployed systems, lessons learned (2011)
  46. Defender (mis) coordination in security games (2013)
  47. Security games for controlling contagion (2012)
  48. Inoculation strategies for victims of viruses and the sum-of-squares partition problem (2006)
  49. Contagion and Observability in Security Domains (2013) — link
  50. Existence Theorems and Approximation Algorithms for Generalized Network Security Games (2010) — link
  51. Attack, Defence, and Contagion in Networks (2014)
  52. Multidefender Security Games (2017)
  53. Interdependent Defense Games with Applications to Internet Security at the Level of Autonomous Systems (2017)
  54. Defending with Shared Resources on a Network (2020)
  55. Scalable min-max multi-objective cyber-security optimisation over probabilistic attack graphs (2019) — link
  56. Keep spending: Beyond optimal cyber-security investment (2023) — link
  57. Security diffusion games: Nash equilibria, inefficiency, and adversarial behavior (2020)
  58. Threshold models of collective behavior (1978)
  59. A simple model of global cascades on random networks (2002)
  60. A new framework for business impact analysis in business continuity management (with a case study) (2014)
  61. The nature of losses from cyber-related events: risk categories and business sectors (2023)
  62. Operational risk: a guide to Basel II capital requirements, models, and analysis (2008)
  63. Operational risk control with Basel II: basic principles and capital requirements (2003)
  64. Using business impact analysis to inform risk prioritization and response (2022)
  65. A survey: When moving target defense meets game theory (2023) — link
  66. A Strategy-Making Method for PIoT PLC Honeypoint Defense Against Attacks Based on the Time-Delay Evolutionary Game (2025) — link
  67. Dangerous games: A literature review on cybersecurity investments (2022)
  68. The economics of information security investment (2002)
  69. Interdependent security (2003)
  70. System reliability and free riding (2004)
  71. The potential for underinvestment in internet security: implications for regulatory policy (2007)
  72. Network externality and incentive to invest in network security (2014)
  73. Malware and market share (2018)
  74. Security investment and information sharing in the market of complementary firms: impact of complementarity degree and industry size (2018)
  75. Economics of malware: Epidemic risks model, network externalities and incentives (2009)
  76. How do you defend a network? (2017)
  77. Network design and defence (2013)
  78. Individual security, contagion, and network design (2017)
  79. Hacking corporate reputations (2026)
  80. Digital technologies and productivity: A firm-level investigation (2023)
  81. Tree networks to assess financial contagion (2020)
  82. An investigation of systemic stress and interdependencies within the Eurozone and Euro Area countries (2015)
  83. Contagion mechanism of liquidity risk in the interbank network (2024) — link
  84. RiskRank: Measuring interconnected risk (2018)
  85. The drivers of cyber risk (2022)
  86. The determinants of systemic risk contagion (2024) — link
  87. Contagion mechanism of liquidity risk in the interbank network (2024)
  88. Multi-agent, multi-site resource allocation under quotas with a Stackelberg leader and network externalities (2023)
  89. Dynamical processes on complex networks (2008)

0 of 97 cited works are in the corpus; resolved via arXiv source bundles, Semantic Scholar and OpenAlex. Corpus-wide: 2518 linked papers.