Abstract

In this paper, we investigate the optimal timing for a company to invest in cybersecurity technology to reduce cyberattack losses. We consider cyber losses following a jump process model, addressing the fat-tailed behavior observed in loss distributions due to cyberattacks. The investment required for implementing cybersecurity technology is also highly variable over time due to ongoing innovations in the field. To account for this uncertainty, we model the evolution of investment costs using a compound Poisson process. Our objective is to minimize the company’s total cost. We convert the optimal stopping problem into a free boundary problem. Using the dynamic programming approach, we solve the associated Hamilton-Jacobi-Bellman equations and obtain semi-closed form solutions for the value function and the optimal investment strategies. Finally, we present numerical examples to illustrate the effect of critical parameters on the optimal investment decision.