# Optimizing Cybersecurity Investments over Time
## 2 Literature Review
A different approach is taken in [46], where a stochastic programming approach is employed to minimize the overall cybersecurity expense under the use of investments only, considering a time-varying investment effectiveness described by an exponential function of the investment. A risk-management tool alternative to investing in cybersecurity is insurance. Insurance is a risk transfer measure whereby the insured is indemnified against cybersecurity-related losses by paying a periodic fixed sum (the premium). The actuarial approach is a more recent streak in cyber-risk management. A thorough discussion of pricing principles (premium setting) as well as a brief review of frequency and severity models for security breaches are contained in [14]. An earlier survey of cyber insurance models is reported in the paper by [47], while a brief review of the state of the cyber insurance market is contained in [13], with similar analyses carried out for Sweden [10], Norway [12], and the US [11]. However, the debate about the use of insurance has gone on for several years, with contrasting opinions. For example, opinions favoring cyber insurance appeared in the papers by [48; 49; 50] (if protection quality is not high). On the other hand, insurance has also been considered a possible factor favoring a market for lemons. Opinions contrary to insurance are shown in [51; 52], where the intrinsic information asymmetry concerning the insured's vulnerability may lead to no insurance market. Additionally, the danger of overpricing insurance policies exists, since the insurer may have imperfect knowledge of risks and may err on the safer side [53; 54]. Several approaches have been proposed to compute the premium. A mean-variance approach has been employed in [55]. A more accurate formula, which, however, requires the knowledge of skewness and kurtosis, has been proposed by [56]. The incorporation of a discount in premium formulas has been proposed in [15] to incentivize all actions aimed at reducing the amount of loss. That proposal has been advocated by [31] for the power sector. Additionally, security audits to design insurance contracts have been proposed in [57]. Since insurance may be reflected in the prices operators charge for their services, the issue of insurance price sustainability also arises [58]. The issue of correlated risks has been dealt with in [59] by resorting to a copula model. Despite being sometimes presented as alternatives, investing in security and buying an insurance policy may be used together, as illustrated in the paper by [60]. Precisely, investing may be used to reduce the insurance premium, as advocated in several papers. The seminal paper in this context is probably that by [PERSON] et al. [15], where a pricing formula has been proposed that incorporates an incentive for vulnerability reduction. That same approach has been suggested in [61], where a risk assessment method based on the use of Bayesian attack graphs has been proposed. However, it has been shown that the mixed strategy may revert to insurance alone under certain conditions (e.g., low potential loss, or either very low or very high vulnerability), and optimal investment decisions may require an accurate estimate of the vulnerability [16].