A stochastic Gordon-Loeb model for optimal cybersecurity investment under clustered attacks
Abstract
We develop a continuous-time stochastic model for optimal cybersecurity investment under the threat of cyberattacks. The arrival of attacks is modeled using a Hawkes process, capturing the empirically relevant feature of clustering in cyberattacks. Extending the Gordon-Loeb model, each attack may result in a breach, with breach probability depending on the system's vulnerability. We aim at determining the optimal cybersecurity investment to reduce vulnerability. The problem is cast as a two-dimensional Markovian stochastic optimal control problem and solved using dynamic programming methods. Numerical results illustrate how accounting for attack clustering leads to more responsive and effective investment policies, offering significant improvements over static and Poisson-based benchmark strategies. Our findings underscore the value of incorporating realistic threat dynamics into cybersecurity risk management.
Cite
@article{arxiv.2505.01221,
title = {A stochastic Gordon-Loeb model for optimal cybersecurity investment under clustered attacks},
author = {Giorgia Callegaro and Claudio Fontana and Caroline Hillairet and Beatrice Ongarato},
journal= {arXiv preprint arXiv:2505.01221},
year = {2026}
}
Comments
18 pages, 10 figures (revised version, included Section 6 on implications for cyber-insurance)