# Optimizing Cybersecurity Investments over Time
## 3 Vulnerability, Investments, and Insurance  
We consider a system exposed to cyberattacks, which can end up with a loss of money. Here we are not so much interested in quantifying the money lost due to those attacks, but the probability that the attack is successful, i.e., the probability that a data breach occurs. We call that probability the vulnerability \(v(\cdot)\) of the system, following the definition in [62]. In this section, we review the notion of vulnerability and describe how it varies under the influence of time and security expenses. We consider data breaches as incidents where an attacker takes (steals) information from a system without the knowledge or authorization of the system's owner. Consistent definitions of data breaches are employed in [20; 34; 35] The vulnerability is the probability that a data breach occurs, conditional on the risk event (see the definition 1.19 of [62]). The intention of the attacker to initiate an attack represents the threat (see the definition 1.18 of [62]). If no money is spent on security, the vulnerability of a system naturally increases over time, since new threats are devised, and the shielding capability of the protection tools in place decays. Following the work of [17], we assume that a logistic function describes the shape of the time-led evolution of the vulnerability. However, we can fight the natural growth of vulnerability by adopting either (or both) approaches to risk management, i.e., taking a risk mitigation policy or a risk transfer one. Risk mitigation is typically achieved by investing in security tools (e.g., antivirus software). Risk transfer consists instead of subscribing to an insurance policy that indemnifies us against the possible losses due to a cyberattack. With risk mitigation, the vulnerability decreases as a function of the investment we carry out in security, though it cannot be reduced to zero. Though several functions have been proposed to describe the impact of investments on vulnerability, the two seminal models by [PERSON] and [PERSON] [20] are still the most widely employed ones. In the following, we refer to those models, respectively, as GL1 and GL2 for short. Since we are interested in examining how the vulnerability evolves over time, we do not assume that investments take place on a single date. Instead, we have a sequence of times \(t_{0},t_{1},t_{2},\ldots,t_{n}\), with \(z_{i}\) being the investment at time \(t_{i}\). We envisage therefore a sawtooth-like vulnerability, which grows within each \((t_{i-1},t_{i})\) interval due to time but is slashed after investments take place at times \(t_{1},t_{2},\ldots,t_{n}\). The logistic function describing the evolution during no-investment intervals is then  
\[v(t)=\frac{V}{1+e^{-k(t-a)}}\quad t_{i}<t<t_{i+1} \tag{1}\]  
where \(V\) is the maximum vulnerability value, \(k\) is the logistic growth rate or steepness of the curve, and the parameter \(a=t_{i}+\frac{1}{k}\ln\Bigl{[}\frac{V}{v(t_{i})}-1\Bigr{]}\) is a function of the vulnerability value after the latest investment. Under the GL1 model, after the \(z_{i}\) investment, the vulnerability decreases to  
\[v(t_{i})=\frac{V}{(1+az_{i})^{\beta}[1+e^{-k(t_{i}-a)}]} \tag{2}\]  
If the GL2 model is adopted instead, the vulnerability decreases to  
\[v(t_{i})=\left[\frac{V}{1+e^{-k(t_{i}-a)}}\right]^{az_{i}+1} \tag{3}\]  
In Figure 1, we see the impact of investments in reducing the vulnerability despite its growth over time. In that case, we have considered a GL1 model with two investment events of EUR 10,000 each. You can see that the periodic reduction of vulnerability makes the overall vulnerability evolution resemble a sawtooth. The risk transfer approach can be adopted as an alternative to risk mitigation. In this case, we may buy an insurance policy, pay the premium, and be indemnified against the potential loss. Though several papers have been devoted to the computation of the fair premium (see, e.g., Ref.