Cyber-Security Investment Strategies in a Stochastic Gordon-Loeb Model with Attacks Clustering

The aim of this work is to determine the optimal cyber-security investment strategy for an entity subject to cyber-attacks. Inspired by the Gordon-Loeb model, we assume that the success rate of cyber-attacks depends on the vulnerability of the security system under threat, which can be reduced investing in security measures. We introduce a dynamic version of the Gordon-Loeb setting, by exploiting Hawkes stochastic processes to model the arrival of attacks. This stochastic framework is crucial to rapidly react to the random changes which characterize cyber-risk. The problem is framed as a Markovian 2-dimensional stochastic control problem with jumps and it is addressed using dynamic programming techniques. The optimal value is characterized by a partial integro-differential equation, which is solved numerically. The corresponding optimal strategy is, hence, explicitly obtained by differentiating the optimal value function.