Poster: Empirical Cybersecurity Investment Decision-Making: Bridging the Gap Between Intuition and Metric-Driven Strategy Nadia Lorraine Niyonsaba University of Twente Enschede, Netherlands n.n.l.niyonsaba@utwente.nl Abhishta Abhishta University of Twente Enschede, Netherlands s.abhishta@utwente.nl Jeroen van der Ham-de Vos University of Twente Enschede, Netherlands j.vanderham@utwente.nl Laura Spierdijk University of Twente Enschede, Netherlands l.spierdijk@utwente.nl Abstract—Organizations are under constant threat of cyber attacks. Hence, they need to have information security measures put in place. Security managers lack methods to quantify how much effort should be invested in protecting their IT assets and training people. We propose developing a metric-based method to guide cybersecurity investments, aimed at improving an organization’s security posture. I. INTRODUCTION Cybersecurity managers lack clear metrics to guide security decisions especially when it comes to investing in security[1]. Optimal security investments are paramount as organizations increasingly rely on Information Technology (IT) [2]. How- ever, organizations rarely have insights into the potential added value offered by security investments. In 2016 RedSeal Inc. polled 200 CEOs; 87% of CEOs who were surveyed expressed the need for better metrics to evaluate cybersecurity investments, and 72% said that the lack of useful metrics for cybersecurity investment assessment was a “major challenge” [3], [4]. [5] and [6] proposed security investment models, but the models have limitations, including being based on security threats and vulnerabilities that are hard to quantify [6], [7], and lacking the organization security context[1], [8]. This research proposes a new decision-making process that is metric-centered and tailored to each organization’s security posture [9], [10]. Typically, organizations use different metrics to quantify and justify their decisions with several business operations but do not follow the same rational decision-making approach to allocate resources for cybersecurity in their organizations[1], [11]. The lack of proper resource allocation for cybersecurity makes information security passive and less important for most organizations, even though one single attack can be fatal and lead to business closure. For example, in 2021, a major gas pipeline (Colonial Pipeline) endured a ransomware attack that led to paying a ransom worth $4.4 million, following the attack. The attack also affected some of the pipeline’s digital programs, shutting it down for several days[12]. Organiza- tions use methods like discounted cash flow, Monte Carlo simulation, decision-tree analysis, and others for uncertain and complex decisions[13]. Nevertheless, interviews conducted by Fig. 1. Situation and complication - Information Technology adds value to business operations leading to success, however, cyberattacks use the same technology as a vector to harm organizations when there are no security measures put in place. [11] reveal that most security executives and other organization managers do not use any investment quantification methods to decide how much their organizations should invest in cybersecurity. Organizations using information technology must imple- ment cybersecurity measures to safeguard their IT assets and data. The increasing reliance on IT for competitive advantage [14] underscores the necessity of cybersecurity. Cyberattacks lead to consequences such as financial losses, reputational damage, and sometimes business closure; emphasizing the im- portance of effective cybersecurity measures [2]. For example, an Illinois hospital closed in 2021 after failing to financially recover from a ransomware attack[15]. Frequently, most orga- nizations don’t put enough information security measures or are passive to protect their IT assets from attacks, due to lack of awareness and lack of proper decision tools and models to quantify how much they shoul