## 6 Discussions
### Limitations and Future Work  
The existing literature on cost-benefit analysis of cybersecurity investment for individuals such as smart-home users is limited. This may be because home users in the past were not as exposed to cyberattacks as they are today in an increasingly digitalized world. It should be stressed that cyberattacks on smart-home users can affect their physical and moral security. As such, we encourage more research on the cybersecurity of smart-home users to protect users from these risks. Regarding the proposed model, it is essential to note that the smart-home environment includes several independent stakeholders, such as IoT device manufacturers, network providers, and cloud service providers. For the sake of simplicity, we have grouped them into a single entity, i.e., \(population_{2}\), to provide a holistic study, as in essence all of these entities must choose between investing or not investing in cybersecurity. We recommend additional research to model the interaction between smart-home users and different stakeholder groups. Moreover, in our model the attacker can target smart-homeusers either directly or indirectly via stakeholders, and cannot target smart-home users and stakeholders at the same time. Future research might address the latter scenario. It is challenging to accurately model the real world with its numerous variables using only a few parameters. While our model is built on realistic assumptions, it is uncertain whether it perfectly captures the reality of smart-home users. To enhance the practicality of our results, future studies must design more sophisticated game models that illustrate greater depth and volume of agents' choices in order to improve the applicability of the findings. Using the Monte Carlo method to simulate such a model is an approach that we recommend. Note that we omitted Monte Carlo simulations in our results, as they were deemed redundant based on previous research [43]. This study demonstrates, both theoretically and through experimental simulations, that multi-agent simulations with Monte Carlo dynamics and evolutionary games with replicator equations produce equivalent results. This could be one of the reasons that other works [15; 16] using evolutionary game theory did not compare directly their evolutionary game-based results with other methods such as Monte Carlo simulations. Verifying the correctness of the parameter values used in our simulation is another challenge. Collecting empirical data to compare theoretical and empirical results is highly recommended. An additional limitation is related to the cost parameters used in our system. Our model focuses only on monetary costs as the study problem; future studies could consider time-related costs in the model. Indeed, while the monetary costs of conducting cyberattacks may be close to zero, the time taken to identify vulnerabilities and develop cyberattacks may be very long, and could be a determining factor that might lead the attacker to refrain from attacking. It is worth noting that our game-theoretic approach works in reality if smart-home users observe the punishments and rewards through their experience. This evidence-based approach is one way to stress the importance of cybersecurity awareness in smart homes. However, achieving the goal of evidence-based security is just as challenging as providing evidence-based healthcare [44]. Interested researchers can investigate evidence-based effects of punishments and rewards on smart-home users' security practices and behaviors. Furthermore, our study does not focus on the content of cybersecurity training, and assumes the effectiveness of such training in preventing cyberattacks. Considering the existence of unknown vulnerabilities, for example, it is evident that cybersecurity training cannot cover all possible vulnerabilities and attack scenarios. This is one of the reasons why our study looked at investing in cybersecurity over the long term through an evolutionary game-theoretic approach.