Supplementary files for the Cyber Security Economics Model (CYSEM) Reliance on cyber security experts' judgment and communication gaps between experts and board members weaken organizations' ability to respond to cyber threats, and research lacks a transparent way to quantify these risks. We propose a novel CYSEM that quantifies security risk in financial terms by integrating Cyber Threat Intelligence (CTI) with the Factor Analysis of Information Risk (FAIR) model. We decided to provide more details of the case study here to better explain and evaluate the CYSEM. In addition, we will briefly introduce the future extension and possible applications of the CYSEM. A Case Study Based on 2017 Equifax Data Breach for Cyber Security Economics Model (CYSEM) Evaluation To illustrate the application of the developed CYSEM, we will conduct a case study based on the 2017 Equifax data breach [3]. Accessing company data related to data breaches and cyber security is notably difficult due to the sensitivity of the information, which companies are generally reluctant to share publicly, even in anonymized and confidential formats. To address this issue, we enhance our modeling with semi-synthetic data, which blends realistic and synthetic data [2]. For this case scenario, we use the 2017 Equifax data breach (please see Table 1 for brief introduction), integrating actual data from the incident report and generating mock data based on expert opinions where the report lacks specifics. This mock data is detailed through inputs from experts with over 15 years of experience in consulting enterprises on cyber security matters, thus simulating real-world practices. Table 1. Brief Review of 2017 Equifax data breach TEF evaluation. In this stage, we will find out the potential threat actors (𝑇𝑛). We will map the characteristics and assets of Equifax with corresponding SDOs and properties in STIX. To be considered for deeper threat analysis, a threat actor must associate with at least one characteristic or asset to an SDO or property. For example, the threat actor FIN7, driven by financial gain, might benefit from the sale of consumer data. Dridex could also target Equifax due to its industry and location. Next, we will evaluate 𝑇𝐸𝐹𝑇𝑛 using Eq. (1) to Eq. (4). Using FIN7 as an example, this group is known for its sophisticated cyberattacks on financial organizations, using tactics such as spear-phishing, network infiltration, and infrastructure acquisition to steal funds or data. Based on the CTI sources, FIN7’s sophistication is advanced, and its resource level is organization-backed, thus, SFIN7 = 0.4, RFIN7 = 0.7 (check Figure 1). The experts in Equifax decided the weight of SFIN7 and RFIN7 are 0.6 and 0.4 respectively. Thus, TCFIN7 is known as 0.4×0.6+0.7×0.4 = 0.52 by Eq. (1). Additionally, FIN7’s primary motivation is financial gain, with a main goal of data theft, particularly targeting payment card data. This Background of Equifax The data breach details Causes of the breach Consequences Equifax is one of the largest credit reporting agencies in U.S. It collects and aggregates information on over 800 million individual consumers and more than 88 million businesses worldwide. The company's primary services include credit reporting and scoring, as well as marketing and fraud prevention services. The data breach exposed the personal information of approximately 147 million consumers. The breach also compromised credit card numbers for about 209,000 U.S. consumers and certain dispute documents containing personal identifying information for approximately 182,000 U.S. consumers. The breach was primarily caused by the vulnerability CVE- 2017-5638 in Apache Struts, a popular open- source software used for building web applications. Equifax failed to patch this known vulnerability in a timely manner. The breach of customer data at Equifax resulted in penalties and settlement fees amounting to $700 million, excess insurance losses of $7.5 million, quarter