# Optimizing Cybersecurity Investments over Time
## 5 The Periodic Investment Solution  
In a mixed cyber-risk management approach, the premium in the insurance component is a consequence of both exogeneous factors (the insurance company setting the base premium, and the external environment posing threats) and one's own choices to invest. The only strategic leverages are then the amount of money to invest and when to invest. In the following we assume that investment is made periodically, so that the only choices are to set the period and the amount of money to invest. However, for the time being, we consider the impact of the investment amount only.  
The straightforward goal is to minimize the overall security expense. Though this could be achieved considering the entire time horizon, for the time being, we adopt a greedy approach, where the expense minimization is conducted at each investment epoch. Our goal is then to find  
\[Z_{i}^{*}=\arg\min_{Z_{i}}E_{i}|T,H, \tag{12}\]  
where the investment periodicity and the overall time horizon are set, and the asterisk denotes the optimal solution.  
In the following we consider all the case resulting from the combination of the liability policies (full, partial, partial with deductibles) and the investment effectiveness models (GL1 and GL2).  
We start with the full liability case. In that case, we have a closed-form solution. We consider first the GL1 model. Following the derivation in [16], we zero the first derivative of the overall expense  
\[\frac{\partial E_{i}^{\text{full}}}{\partial Z_{i}}=1-\frac{P_{0}r\alpha \beta V}{(1+e^{-kT}(V/v_{i-1}-1))(1+\alpha Z_{i})\beta^{+1}}=0. \tag{13}\]  
After some passages, the resulting optimal investment is  
\[Z_{i}^{*}=\frac{1}{\alpha}\Bigg{[}\bigg{(}\frac{P_{0}r\alpha\beta V}{1+e^{- kT}(V/v_{i-1}-1)}\bigg{)}^{\frac{1}{p+1}}-1\Bigg{]}. \tag{14}\]  
This extremal investment point is a sure minimum, since the second derivative is positive, being a product made of all positive factors:  
\[\frac{\partial E^{\text{full}}}{\partial Z_{i}}=\frac{P_{0}r\alpha^{2}\beta( \beta+1)V}{(1+e^{-kT}(V/v_{i-1}-1))(1+\alpha Z_{i})\beta^{+2}} \tag{15}\]  
However, the straight mathematical derivation may lead us to a negative investment, which obviously makes no sense. Hence, the solution is valid if the following condition holds  
\[\frac{P_{0}r\alpha\beta V}{1+e^{-kT}(V/v_{i-1}-1)}>1 \tag{16}\]  
In general, the validity is granted when  
* the vulnerability \(v_{i}\) is close to the maximum vulnerability \(V\)
* the maximum vulnerability \(V\) is large;
* the investment epochs are not too close to each other.  
A similar development can be conducted when the GL2 model applies. In that case, the first derivative is  
\[\frac{\partial E^{\text{full}}}{\partial Z_{i}}=1+P_{0}r\alpha v(t_{i})^{ \alpha Z_{i}+1}\ln(v(t_{i}))=0 \tag{17}\]which reaches its minimum at  
\[Z_{i}^{*}=-\frac{1}{\alpha}\Bigg{[}\frac{\ln(-P_{0}\pi\alpha\ln(\frac{V}{1+e^{-kT }(V/v_{i-1}-1)})}{\ln(\frac{V}{1+e^{-kT}(V/v_{i-1}-1)})}+1\Bigg{]}. \tag{18}\]  
The validity conditions for this expression have been thoroughly examined in [16].  
We can now move to the case where the insurance company sets a ceiling for its liability. When the loss does not exceed the upper bound \(u\), the expressions stay the same as in the full liability case. Instead, when \(\lambda>u\), we obtain the following derivatives. For the GL1 model, we obtain  
\[\frac{\partial E_{\text{i}}^{\text{partial}}}{\partial Z_{i}}=1-  
\[\frac{\partial E_{\text{i}}^{\text{deduct}}}{\partial Z_{i}}=1+P_{0} \tau\kappa\bigg{(}\frac{V}{1+e^{-k(t_{i}-a)}}\bigg{)}^{aZ_{i}+1}\ln\bigg{(}\frac{ V}{1+e^{-k(t_{i}-a)}}\bigg{)} \tag{22}\] \[+\frac{V}{k}\frac{q(\lambda-u+\ell)}{t_{i+1}-t_{i}}\frac{\alpha( e^{kT}-1)}{V+v_{i}(e^{kT}-1)}\bigg{(}\frac{V}{1+e^{-k(t_{i}-a)}}\bigg{)}^{aZ_{i}+1} \ln\bigg{(}\frac{V}{1+e^{-k(t_{i}-a)}}\bigg{)}=\] \[1+\alpha\bigg{(}\frac{V}{1+e^{-kT}(V/v_{i-1}-1)}\bigg{)}^{aZ_{i} +1}\ln\bigg{(}\frac{V}{1+e^{-kT}(V/v_{i-1}-1)}\bigg{)}\times\] \[\bigg{[}P_{0}\tau+\frac{V}{k}\frac{q(\lambda-u+\ell)}{T}\frac{e^{ kT}-1}{V+v_{i}(e^{kT}-1)}\bigg{]}=0\]