Gordon–Loeb model
The Gordon–Loeb model is a mathematical economic model analyzing the optimal investment level in information security. Investing to protect company data involves a cost that, unlike other investments, usually does not generate profit. It does, however, serve to prevent additional costs. Thus, it's important to compare how expensive it is to protect a specific set of data, with the potential loss in case said data is stolen, lost, damaged or corrupted. To draft this model, the company must possess knowledge of three parameters: These three parameters are multiplied together to provide the median money loss  with no security investment. From the model we can gather that the amount of money a company spends in protecting information should, in most cases, be only a small fraction of the predicted loss (for example, expected value of a loss following a security breach). Specifically, the model shows that it is generally inconvenient to invest in informatics security (including cybersecurity or computer security related activities) for amounts higher than 37% of the predicted loss. The Gordon–Loeb model also shows that, for a specific level of potential loss, the amount of resources to invest in order to protect an  information set does not always increase with the increase in vulnerability of said set. Thus, companies can enjoy greater economic returns by investing in cyber/information security activities aimed to increase the security of data sets with a medium level of vulnerability. In other words, the investment in safeguarding a company's data reduces vulnerability with decreasing incremental returns. The Gordon–Loeb Model was first published by Lawrence A. Gordon and Martin P. Loeb in their 2002 paper, in "ACM Transactions on Information and System Security", entitled "The Economics of Information Security Investment" The paper was reprinted in the 2004  book "Economics of Information Security". Gordon and Loeb are both professors at the University of Maryland's Robert H. Smith School of Business. The Gordon–Loeb Model is one of the most well accepted analytical models for the economics of cyber security. The model has been widely referenced in the academic and practitioner literature. The model has also been empirically tested in several different settings. Research by mathematicians Marc Lelarge and Yuliy Baryshnikov generalized the results of the Gordon–Loeb Model. The Gordon–Loeb model has been featured in the popular press, such as "The Wall Street Journal" and "The  Financial Times".