Real Options Models for Proactive Uncertainty-Reducing Mitigations and Applications in Cybersecurity Investment Decision Making

Michel Benaroch ()
Additional contact information
Michel Benaroch: Martin J. Whitman School of Management, Syracuse University, Syracuse, New York 13210

Information Systems Research, 2018, vol. 29, issue 2, 315-340

Abstract: Managerial flexibility, or real options , embedded in information technology (IT) investments allows resolving uncertainty not only by passively waiting for new information to arrive during deferral but also by proactively deploying mitigations . Classic real options models fail to account for the value of proactive uncertainty-reducing mitigations, since they assume that uncertainty is fixed or follows a continuous, time-dependent dynamics. We present adaptations of these models that address this shortcoming. In our models, zero or more mitigations can be applied in varying sequences, mitigations have impulse-type effects on uncertainty reduction, and mitigations’ effects can be complementary, substitutive, or synergetic. These traits make the value of mitigations path dependent and conditional on the uncertainty-reduction ability of earlier deployed mitigations. We operationalize the effects of mitigations in the IT and cybersecurity investment contexts. We also apply the adapted models to a real-world cybersecurity investment case from a Japanese company. Investments in multiple cybersecurity mitigations are typically treated as having a multiplicative effect that leads to overinvestment in mitigations. Our models avoid this problem, permitting to lower cybersecurity costs without compromising on loss prevention. More generally, our models allow implementing the real options logic more fully by supporting both passive and proactive IT investment risk management. The online appendix is available at https://doi.org/10.1287/isre.2017.0714 .

Keywords: real options models; uncertainty-reducing mitigations; cybersecurity investments; IT investment risk management; active risk management (search for similar items in EconPapers)
Date: 2018
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (7)

Downloads: (external link)
https://doi.org/isre.2017.0714 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:inm:orisre:v:29:y:2018:i:2:p:315-340

Access Statistics for this article

More articles in Information Systems Research from INFORMS Contact information at EDIRC.
Bibliographic data for series maintained by Chris Asher ().