# Optimizing Cybersecurity Investments over Time
## 4 The Security Expense Minimization Problem  
As hinted at in Section 3, we consider a mixed strategy, where the company wishing to edge against cybersecurity-related losses invests in security and buys cybersecurity  
Figure 1: Impact of investments on vulnerability (GL1 model with \(\alpha=2.7\cdot 10^{-5}\), \(\beta=1.1\)) (logistic growth model with \(V=0.95\), \(k=2.68\)) (attack probability \(q=0.7\)).  
insurance at the same time. The company's expense in security consists of both components. In this section, we provide a mathematical formulation of those components and define the security expense minimization problem.  
In the following, we assume that the probability \(q\) of an attack does not depend on the specific epoch but just on the duration of the time interval \([t_{i},t_{i+1}]\). For the time being, we assume that investment is carried out periodically so that \(t_{i+1}-t_{i}=T,\forall i\). We also assume that the loss \(\lambda\) in the case of a successful attack is a fixed quantity (this is quite a simplifying assumption, though the modeling of severity for security breaches calls for a probability density function model [39]).  
In the case of full liability, the company invests in security and buys an insurance policy covering any loss at the same time. The overall expense is simply the sum of two components (investment and insurance premium):  
\[E^{\text{full}}=Z+P, \tag{5}\]  
where \(Z=\sum_{i}^{u}Z_{i}\) is the overall investment throughout the \(n\) periods, and \(P=\sum_{i}^{u}P_{i}\) is similarly the sum of the insurance premiums paid over the periods. In particular, by recalling Equation (4), at the \(i\)-th period we have  
\[E^{\text{full}}_{i}=Z_{i}+P_{0}[1-r(1-v_{i})], \tag{6}\]  
where \(v_{i}=v(t_{i})\).  
Similarly, if the insurance policy includes an upper limit \(u\) on liability, the overall expense will be  
\[E^{\text{partial}}=\begin{cases}Z+P\quad\text{if}\quad\lambda\leq u\\ Z+P+R\quad\text{if}\quad\lambda>u\end{cases} \tag{7}\]  
where \(q\) is the probability that an attack takes place, and \(R=\sum_{i=1}^{u}R_{i}\) is the residual loss not covered by insurance.  
For the \(i\)-th period, the residual loss is  
\[R_{i}=q(\lambda-u)\overline{v}_{i}, \tag{8}\]  
where \(\overline{v}_{i}\) is the average vulnerability in \([t_{i},t_{i+1}]\), since we must take into account that the timing of the data breach is unknown, and the probability of its success changes along the interval till the next investment instalment. After recalling Equation (1), we obtain  
\[\overline{v}_{i}=\frac{1}{t_{i+1}-t_{i}}\int_{t_{i}}^{t_{i+1}}v(t)dt=\frac{V} {kT}\ln\Bigl{[}1+\frac{v_{i}}{V}\Bigl{(}e^{kT}-1\Bigr{)}\Bigr{]} \tag{9}\]  
The expense in the \(i\)-th period is then  
\[E^{\text{partial}}_{i}=\begin{cases}Z_{i}+P_{0}[1-r(1-v_{i})]\quad\text{if} \quad\lambda\leq u\\ Z_{i}+P_{0}[1-r(1-v_{i})]+q(\lambda-u)\frac{V}{kT}\ln\Bigl{[}1+\frac{v_{i}}{V} \Bigl{(}e^{kT}-1\Bigr{)}\Bigr{]}\quad\text{if}\quad\lambda>u\end{cases} \tag{10}\]  
We can now consider the third case, where we have both a lower bound \(\ell\) and an upper bound \(u\) on liability. We refer to this case as partial liability with deductibles. The overall expense in the \(i\)-th period is then  
\[E^{\text{deduct}}_{i}=\left\{\begin{array}{ll}Z_{i}+P_{0}[1-r(1-v_{i})]+ \lambda q\frac{V}{kT}\ln\Bigl{[}1+\frac{v_{i}}{V}\Bigl{(}e^{kT}-1\Bigr{)} \Bigr{]}&\text{if}\ \lambda\leq\ell\\ Z_{i}+P_{0}[1-r(1-v_{i})]+\ell q\frac{V}{kT}\ln\Bigl{[}1+\frac{v_{i}}{V} \Bigl{(}e^{kT}-1\Bigr{)}\Bigr{]}&\text{if}\ \ell<\lambda\leq u\\ Z_{i}+P_{0}[1-r(1-v_{i})]+(\lambda-u+\ell)q\frac{V}{kT}\ln\Bigl{[}1+\frac{v_{i}} {V}\Bigl{(}e^{kT}-1\Bigr{)}\Bigr{]}&\text{if}\ \lambda>u\end{array}\right. \tag{11}\]