# Optimizing Cybersecurity Investments over Time
## 2 Literature Review  
In this paper, we deal with a problem in cyber-risk management. We can classify the literature of interest about this topic into four primary groups: those sketching a general cyber-risk management framework; those describing the mitigation approach by identifying a relationship between investments in security and vulnerability; those analyzing the pricing proposition in insurance; and those considering a mixed investment-insurance approach. A general taxonomy of risk-management approaches is contained in the recent paper by [PERSON] et al. [8]. In the class of papers describing a general framework to address cyber-risks, a major subclass is represented by those papers concerning critical infrastructures, where the subject of risk interdependence is particularly relevant. That dependence is described in [18], where the growing importance of cyber-risks is highlighted. In order to decide which approach to use in the toolbox of risk management (including tolerance), [PERSON] et al. propose a scoring system coupled with a decision tree [19]. The most established model to relate security investments and vulnerability reduction, which allows us to compute the optimal investment to be made in security, is due to [PERSON] (GL) [20], who actually proposed two models, which we refer to as GL1 and GL2 in the following. The use of GL models in a practical setting has been investigated in [21; 22]. A special form of the GL1 model was derived by [23] when attacks target a particular node (one-to-one attacks) (the equivalence of the two models was proven by [24]). The GL1 model has been used in several papers [25; 26; 27; 28; 29], and a dynamic extension has also been proposed by [30]. For the GL2 model also, an equivalent model was derived in [23] to model attacks that propagate epidemically over a scale-free network (opportunistic attacks). The equivalence of the GL2 model and that proposed by [23] was proven by [24]. The GL2 model was used, e.g., by [15; 16; 25; 28; 29; 31; 32; 33]. Three additional models to describe the impact of investments on the breach probability have been proposed in [34]. Additionally, three more models, respectively named the exponential power class function, the proportional hazard class model, and the Wang transform model, have been proposed in [35]. The exponential power class function has been employed by [36] to derive an optimal mix of mitigation measures and investments in knowledge and expertise. All the three models proposed by [PERSON] have been employed by [37] to investigate the competition between two cloud providers. The economic consequences of cyberattacks have also been a matter of concern for a long time, as shown in the cyber-risk management framework proposed by [38]. A taxonomy has been proposed to classify the costs of cybercrime [39]. The consequences on the market value of companies must be accounted for in addition to the direct losses suffered by companies and their customers [40; 41]. Of course, the ultimate goal is to estimate the actual costs, which is the subject of several papers, e.g., [26; 42; 43; 44; 45]. The decision to invest may also be related to the risk-taking attitude of the company [25]. However, not investing enough in security may lead to liability consequences as well [24]. Though most papers adopt a straightforward net profit maximization approach, a mixed-integer linear programming formulation has been adopted in [32] for an Industry 4.0 supply chain. A game-theoretic approach is employed in [29] to analyze the investment strategies of two interconnected firms under different types of attack (targeted vs opportunistic). A similar context has been further explored in [33], where a company with systems deployed both in its headquarters and some branches has been considered. The optimal trade-off between investing in knowledge and expertise versus investing in deploying mitigation measures has been investigated by [36].