Key research themes
1. How do economic externalities influence optimal cybersecurity investment by private firms?
This research theme investigates the underinvestment in cybersecurity by private sector firms due to the presence of externalities—costs or risks imposed on others that individual firms do not internalize. It focuses on extending economic models to quantify the gap between private and socially optimal cybersecurity spending. Understanding this helps in designing better regulatory incentives and interventions to correct market failures, enhancing collective cyber resilience.
2. To what extent do information security professionals’ risk perceptions and behaviours deviate from expected value maximization in cybersecurity investment decisions?
This theme examines the behavioural and cognitive biases influencing cybersecurity risk assessment and investment decisions by information security professionals. It challenges the assumption that these professionals behave as rational expected value maximizers, instead revealing systematic risk and ambiguity aversion, framing effects, and tensions between security and operability preferences. This insight is crucial for improving risk assessment methodologies and organizational security investment strategies.
3. How can cost-benefit and financial analysis methodologies improve organizational security investment decisions under economic and operational constraints?
This area focuses on applying quantitative economic tools such as cost-benefit analysis (CBA), net present value (NPV), and financial forecasting to optimize security investments within organizations, balancing protection effectiveness against operational costs. With economic security viewed as integral to organizational stability, these methodologies help justify and prioritize security expenditures, accounting for direct costs, externalities, and strategic business considerations.