# Optimizing Cybersecurity Investments over Time
## 1 Introduction  
Cybersecurity costs exhibit a continuous growth trend, with a 15% year-on-year increase (See the estimate by Cybersecurity Ventures on [[https://cybersecurityventures.com/cybersecurity-damage-costs-10-trillion-by-2025/](https://cybersecurityventures.com/cybersecurity-damage-costs-10-trillion-by-2025/)]([https://cybersecurityventures.com/cybersecurity-damage-costs-10-trillion-by-2025/](https://cybersecurityventures.com/cybersecurity-damage-costs-10-trillion-by-2025/)), (accessed on 15 May 2022)). A faster-than-exponential growth was observed in the years from 2000 to 2006 [1]. Later, an investigation into breaches up to 2015 reported an increase in the overall frequency of large data breaches [2]. Finally, a steady increase of cyber-incidents was noted in the years up to 2018 in [3]. Though most cybersecurity literature is devoted to analyzing vulnerabilities and their reduction, the sheer growth of cyber-risk threats calls for a broader range of countermeasures, which do not involve just the engineering side.  
The panorama of risk-management techniques includes risk transfer (e.g., insurance) and risk avoidance in addition to risk mitigation (with the latter category essentially incorporating all the technical countermeasures). The classification of strategies adopted for cyber-risk management is not different from what is considered for general risk management [4, 5, 6]. It is to be considered that, though risk avoidance is typically included in the set of risk-management strategies, is not a viable option in many cases, since it could lead to a significant sacrifice of usability [7]. A historical survey of cyber-risk management is provided by [8].  
After the early debate on the insurability of cyber-risks [9], a market for insurance has actually developed [10, 11, 12, 13]. Pricing methods have been proposed to compute the insurance premium (see, e.g., [14]).  
More recently, a new approach, based on the joint use of risk mitigation and risk transfer measures, has been proposed [15, 16]. In that approach, investments allow us to reduce the vulnerability, which in turn is reflected in a lower premium. So far, those investigations have considered investments in security as a one-off option. However, the reality is that companies must keep investing in security to confront new threats.  
The net effect of the evolving landscape is a natural growth of vulnerability over time. A logistic model has been recently proposed in [17] to describe that growth. The joint mitigation-transfer approach must be reassessed in this context of growing vulnerability.  
In this paper, we approach the problem of devising a joint risk-management approach in the face of a growing vulnerability by looking for the optimal investment amount to minimize the overall security expense (investment plus insurance) when threats keep growing and call for a sequence of investments. Here, we adopt a greedy approach where optimization is sought at each investment step rather than globally over a time horizon. Our major contribution is evaluating the optimal investment for a sequence of epochs when insurance and investment are employed jointly for three insurance liability cases (full liability, partial liability, and partial liability with deductibles).  
After the literature review in Section 2, we describe the models employed for the effectiveness of investments and vulnerability growth over time in Section 3. The investment optimization problem is posed in Section 4 and solved in Section 5 for the scenario where investments are carried out periodically. Finally, in Section 6, we report some results.