Scholarlink

<p>The sharp increase in damages caused by cyberattacks and cybersecurity budgets at German companies brings the economic justification of cybersecurity investments to the forefront. Quantifying these investments, however, is challenging since they aim to reduce losses from potential future incidents. In this context, metrics can prove to be a&#xa0;valuable instrument for quantifying relevant parameters.</p><p>In this paper, a&#xa0;systematic literature review is conducted to identify current metrics for the economic justification of cybersecurity investments and to classify them according to practice-relevant criteria. The analysis focuses on decision-theoretic approaches. A&#xa0;structured literature search across four academic databases identified 24&#xa0;relevant articles containing 19&#xa0;distinct metrics. The classification is based on five criteria: methodological approach (benefit maximization, cost minimization, ROI-based), temporal scope (static/dynamic), risk transfer to insurance, budget consideration, and application context. The analysis reveals that most metrics follow a&#xa0;static perspective and only a&#xa0;few consider risk transfer to insurance providers. Budget restrictions are frequently not explicitly incorporated into the metrics, and a&#xa0;general application context is typically assumed.</p><p>From a&#xa0;practical perspective, the findings demonstrate that the methodological approach has significant implications for investment recommendations, and that dynamic models with insurance integration can lead to more economically sound decisions. Future research on cybersecurity metrics should address the standardization of input variables, the development of integrated dynamic insurance models, and the empirical validation of theoretical models.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Wirtschaftliche Rechtfertigung von Cybersicherheitsinvestitionen – eine systematische Literaturanalyse zu Cybersicherheitskennzahlen

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年4月22日

查看全文
  • Dennis Kelm,
  • Denitsa Kirova,
  • Till J. Winkler

摘要

The sharp increase in damages caused by cyberattacks and cybersecurity budgets at German companies brings the economic justification of cybersecurity investments to the forefront. Quantifying these investments, however, is challenging since they aim to reduce losses from potential future incidents. In this context, metrics can prove to be a valuable instrument for quantifying relevant parameters.

In this paper, a systematic literature review is conducted to identify current metrics for the economic justification of cybersecurity investments and to classify them according to practice-relevant criteria. The analysis focuses on decision-theoretic approaches. A structured literature search across four academic databases identified 24 relevant articles containing 19 distinct metrics. The classification is based on five criteria: methodological approach (benefit maximization, cost minimization, ROI-based), temporal scope (static/dynamic), risk transfer to insurance, budget consideration, and application context. The analysis reveals that most metrics follow a static perspective and only a few consider risk transfer to insurance providers. Budget restrictions are frequently not explicitly incorporated into the metrics, and a general application context is typically assumed.

From a practical perspective, the findings demonstrate that the methodological approach has significant implications for investment recommendations, and that dynamic models with insurance integration can lead to more economically sound decisions. Future research on cybersecurity metrics should address the standardization of input variables, the development of integrated dynamic insurance models, and the empirical validation of theoretical models.