There is an answer.
“Given that AI has increased the number and magnitude of cyberattacks, cybersecurity has become even more important today than it was in the pre AI world,” said Lawrence A. Gordon, EY Alumni Professor of Managerial Accounting and Information Assurance at the University of Maryland Robert H. Smith School of Business. “Organizations in both the private and public sectors are grappling with the challenge of determining how much they should budget for cybersecurity related activities.”
Gordon is a co-author of a paper entitled “Cybersecurity Budgeting: A Cyber Risk Perspective.” Martin P. Loeb, professor emeritus of accounting and information assurance and Lei Zhou, research scholar and academic director of Smith’s MS in Accounting program are the other authors. The paper builds on the Gordon-Loeb Model, long considered a foundational framework for determining optimal cybersecurity investment.
Cybersecurity budgeting must shift from a compliance driven or cost avoidance mindset to a cyber risk perspective – a view directly aligned with the U.S. Securities and Exchange Commission’s 2023 rules on cybersecurity risk management and governance, according to the paper.
Challenges
Their framework addresses eight persistent challenges organizations face when setting cybersecurity budgets, including:
- Invisible cost savings from prevented attacks
- Extreme uncertainty in estimating breach probability
- Difficulty quantifying potential losses, especially catastrophic ones
- Measuring the productivity of cybersecurity investments
- Rapid growth in attack sophistication
- Externalities that spill across supply chains and customers
- Misalignment between budget authority (often CFOs) and cybersecurity responsibility (CISOs/CIOs)
- Cybersecurity disclosure rules that create added compliance requirements for publicly traded companies
By expressing cyber risk in simple mathematical terms – expected loss equals the probability of a successful attack multiplied by the potential loss – the Gordon-Loeb Model helps organizations identify how much they should ideally invest in cybersecurity.
The authors show this optimal amount generally should not exceed 37 percent of the expected loss, giving executives a practical, economically grounded benchmark to guide their budgeting decisions.
Although the model is static, the authors emphasize its adaptability. Key parameters –probability of attack, potential loss, and the effectiveness of security investments – can continuously update as new information emerges. This makes the framework well suited for today’s fast changing digital environment, where AI enabled threats evolve rapidly and cybersecurity budgets must remain flexible.
The paper also highlights how incorporating externalities – the spillover costs borne by customers, partners, and even national security – can help organizations invest at a more socially efficient level, addressing chronic underinvestment in cybersecurity.
Actions for Executives
For executives, the research offers actionable insights:
- Cybersecurity budgeting should integrate into enterprise risk management, not treated as a technical silo.
- Risk based metrics, not traditional accounting variances, are more appropriate for evaluating cybersecurity performance.
- Linking cybersecurity outcomes to senior executive compensation, as some firms have begun to do, can help resolve incentive misalignment.
- AI and data analytics can strengthen real time estimation of cyber risk and improve budget responsiveness.
As the Gordon-Loeb Model shaped cybersecurity investment thinking for more than two decades, cited widely by academics, practitioners, and policymakers, this new paper, Gordon said, “extends that legacy, offering organizations a rigorous, economically grounded way to navigate one of the most complex budgeting challenges of the digital era.”
Click here to read the entire paper.