The finance of cybersecurity: Quantitative modeling of investment decisions and net present value

Mazen Brho, Amer Jazairy and Aaron V. Glassburner

International Journal of Production Economics, 2025, vol. 279, issue C

Abstract: Despite the growing literature on cybersecurity investment, significant gaps remain unaddressed. First, the existing literature does not differentiate between cybersecurity expenditures, namely investment versus spending, despite the differences in their financial treatments. Second, the literature predominantly employs economic and risk-based models, in which the incorporation of financial parameters is limited. Third, the literature focuses on quantifying market (stock) loss of cyberattacks or conducting a cost-benefit analysis of cybersecurity investments but has yet to bridge these two areas. Thus, our objective is to introduce a new financial model, the Alpha Model, that addresses these gaps. We first provide distinctions between cybersecurity investment (capital expenditure) and spending (operational expenditure). Grounded in Relative Valuation Models and Optimal Capital Structure Theory, we quantify the upper-bound of optimal cybersecurity investment by utilizing book and market values of equity and debt. We also demonstrate that the Net Present Values (NPV) of cybersecurity investment is considerably lower than its book value by incorporating financial parameters of equity and debt financing, inflation-adjusted capital cost, and tax credits of depreciation and interest. To validate our model, we conduct an empirical test using data from the S&P500 index during 2018–2023. We present practical implications to key stakeholders, including: (1) industry executives to financially quantify cybersecurity investments and ascertain their actual NPVs, individually and collaboratively with supply chain partners; (2) cybersecurity solution providers to promote business investments in cybersecurity; and (3) insurance providers to price premiums with higher NPVs than the corresponding investments. We also offer several avenues for further research.

Keywords: Alpha model; Cybersecurity investment; Cybersecurity economics; Cyberattacks; Cyber risk management; Supply chain finance (search for similar items in EconPapers)
Date: 2025
References: View references in EconPapers View complete reference list from CitEc
Citations:

Downloads: (external link)
http://www.sciencedirect.com/science/article/pii/S0925527324003050
Full text for ScienceDirect subscribers only

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:eee:proeco:v:279:y:2025:i:c:s0925527324003050

DOI: 10.1016/j.ijpe.2024.109448

Access Statistics for this article

International Journal of Production Economics is currently edited by Stefan Minner

More articles in International Journal of Production Economics from Elsevier
Bibliographic data for series maintained by Catherine Liu ().