Cybersecurity Budgeting: A Cyber Risk Perspective
DOI:
https://doi.org/10.14738/tecs.1404.12106Keywords:
Cybersecurity, Budgeting, Cyber, RiskAbstract
Given the prominence of cyber risk, executives in organizations must address the following question: How much should be budgeted for cybersecurity? The primary objective of this paper is to provide a rigorous economic framework for analyzing and addressing the critical challenges associated with developing a cybersecurity budget, with particular emphasis on investments to prevent cyber breaches. The proposed framework is grounded in the Gordon–Loeb Model, which provides a theoretical basis for deriving the optimal level of investment in cybersecurity (Gordon and Loeb, 2002). The paper makes four contributions to the existing literature on cybersecurity budgeting. First, it identifies a comprehensive list of challenges associated with budgeting for cybersecurity activities within an organization. Second, it demonstrates that cybersecurity budgeting is best viewed from a cyber risk perspective and that this perspective is consistent with the U.S. Securities and Exchange Commission (SEC) rules concerning Cybersecurity Risk management, Strategy, and Governance (SEC, 2023). Third, it provides insight into the economic rationale for placing an upper-bound on initial cybersecurity budgets. Fourth, it examines the frequent misalignment between authority and responsibility for cybersecurity spending and proposes mechanisms to better align the incentives.
References
AFCEA (Armed Forces Communications and Electronics Association) Cyber Committee, 2013. The Economics of Cybersecurity: A Practical Framework for Cybersecurity Investment. See: https://www.afcea.org/mission/intel/documents/EconomicsofCybersecurityFinal10-24-13.pdf , pp. 1-15.
Scholar Publishing Allianz, 2025. Allianz Risk Barometer 2025 - Global risk #1: Cyber incidents (38%). See: https://commercial.allianz.com/news-and-insights/expert-risk-articles/allianz-risk-barometer-2025-cyber-incidents.html?utm_source=chatgpt.com).
Aon, 2025. Global Risk Management Survey. See: https://www.aon.com/en/insights/reports/global-risk-management-survey/top-10-globalrisks?collection=18a5358e-4f8c-4e2d-8fb3-291c7672dfaa&parentUrl=/en/insights/reports/globalrisk-management-survey#aon-collection-detail-item-{29CAED57-3308-4475-9864-638B107B0D5B.
Bodin, L.D., Gordon, L.A. and Loeb, M.P., 2008. Information security and risk management. Communications of the ACM. Vol. 51(4), pp.64-68.
Brownell, P., 1981. Participation in budgeting, locus of control and organizational effectiveness. The Accounting Review, 56 (October), pp. 844-860.
Brownell, P., 1982. The role of accounting data in performance evaluation, budgetary participation and organizational effectiveness, Journal of Accounting Research (Spring), pp. 12-27.
Brownell, P., 1983. Leadership style, budgetary participation and managerial behavior. Accounting, Organizations and Society, Vol. 8, No.4, 307-321.
Carfora, M. F. and A. Orlando, 2024. Application of the Gordon Loeb model to security investment metrics: a proposal. Data Science in Finance and Economics, Vol. 4, No. 4, pp. 601-614, See: https://www.aimspress.com/article/doi/10.3934/DSFE.2024025?viewType=HTML.
Covaleski, M. A. and M. W. Dirsmith, 1986. The budgetary process of power and politics. Accounting, Organizations and Society, Vol. 11, No. 3, pp. 193–214.
Ebel, A. and D. Mitra, 2024. Economics and optimal investment policies of Attackers and Defenders in cybersecurity. Journal of Cybersecurity, Vol. 10, Issue 1 (see: https://academic.oup.com/cybersecurity/article/10/1/tyae019/7900094).
Eling, M., K. Jung, and J. Shim, 2022. Unraveling heterogeneity in cyber risks using quantile regressions. Insurance: Mathematics and Economics, Vol. 104, pp. 222-224.
Ermicioi, N. and X. Liu, 2021. An Interdisciplinary Study of Cybersecurity Investment in the Nonprofit Sector. American Journal of Management, Vol. 21(5), pp. 39-50.
Fanelli, B. R. Pessanha, A. Gwiazdowski, A. Chng-Castor, and G. Auger, 2017. 2017 State of Cybersecurity Among Small Businesses in North America. Better Business Bureau. See: http://saginllc.com/wp-content/uploads/2017/10/Cybersecurity_FINAL_LoRes_Embargoed.pdf.
Fedele, A. and C. Roner, 2022. Dangerous Games: A literature review of cybersecurity investments. Journal of Economic Surveys, Vol. 36, No. 1, pp. 157-187.
Fielder, A, S. Konig, E. Panaousis, S. Shauer, and S. Rass, 2018. Risk assessment uncertainties in cybersecurity investments. Games, 9(34), pp. 1-14. See: https://www.researchgate.net/publication/325681751_Risk_Assessment_Uncertainties_in_Cybersecurity_Investments.
Gordon, L. A., S. Haka, and A. G. Schick, 1984. Strategies for information systems implementation: The case of zero-base budgeting. Accounting, Organizations and Society, Vol. 9, No. 2, pp. 111-123.
Gordon, L. A. and M.P. Loeb, 2001. A Framework for Using Information Security as a Response to Competitor Analysis Systems. Communications of the ACM, September, pp.
Gordon, L. A. and M. P. Loeb, 2002. The Economics of Information Security Investment. ACM Transactions on Information and System Security, 5 (4), pp. 438–457.
Scholar Publishing Gordon, L. A., M. P. Loeb and W. Lucyshyn, 2003. Sharing information on computer systems security: An economic analysis. Journal of Accounting and Public Policy, Vol. 22, No. 6, pp. 461-485.
Gordon, L.A., M.P. Loeb and W. Lucyshyn, 2003. Information Security Expenditures and Real Options: A Wait-and-See Approach. Computer Security Journal, Vol. 19, No. 2, pp. 1-7.
Gordon, L.A., M.P. Loeb, W. Lucyshyn, and L. Zhou, 2015a. The Impact of Information Sharing on Cybersecurity Underinvestment: A Real Options Perspective. Journal of Accounting and Public Policy, Vol. 34, No. 5, pp. 509-519.
Gordon, L.A., M.P. Loeb, W. Lucyshyn, and L. Zhou, 2015b. Externalities and the Magnitude of Cybersecurity Underinvestment by Private Sector Firms: A Modification of the Gordon-Loeb Model. Journal of Information Security, pp. 24-30.
Gordon, L.A., M.P. Loeb, and L. Zhou, 2016. Investing in Cybersecurity: Insights from the Gordon-Loeb Model. Journal of Information Security, pp. 49-59.
Krutilla, K., A. Alexeev, E. Jardine, and D. Good, 2021. The Benefits and Costs of Cybersecurity Risk Reduction: A Dynamic Extension of the Gordon and Loeb Model. Risk Analysis, Vol. 41, No. 10, pp. 1795-1808.
Marciano, 2024. The amazing history, present, and future of business budgeting. Updated May 29, 2024. See: https://www.datarails.com/then-and-now-businessbudgets/#:~:text=The%20evidence%20for%20the%20traditional,taking%20from%204%2D6%20months.
Otley, D., 1999. Performance management: a framework for management control systems research. Management Accounting Research, 10, pp. 363-382.
PwC, 2025. 2026 Global Digital Trust Insights: C-suite playbook and findings -- New world, new rules: Cybersecurity in an era of uncertainty. See: https://www.pwc.com/us/en/services/consulting/cybersecurity-risk-regulatory/library/globaldigital-trust-insights.html.
Pyhrr, P., 1973. Zero-Base Budgeting, New York: John Wiley and Sons, Inc., 1973.
Skeoch, H. R., 2022. Expanding the Gordon-Loeb Model to Cyber-Insurance. Computers & Security, Vol. 112, 1025333.
Securities and Exchange Commission, 2023. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure. Final Rule, see: https://www.sec.gov/files/rules/final/2023/33-11216.pdf. Securities and Exchange Commission, S-K 106, 1/22/2026. See: https://www.ecfr.gov/current/title-17/chapter-II/part-229/subpart-229.100/section-229.106.
Shevchenko, P. V., J. Jang, M. Malavasi, G. W. Peters, G. Sofronov, and S. Truck, 2023. The nature of losses from cyber-related events: risk categories and business sectors. Journal of Cybersecurity, Simons, R., 1987. Accounting Control Systems and Business Strategy: An Empirical Analysis. Accounting, Organizations and Society, Vol. 12, No. 4, pp. 357–374.
Ursu, I., 2024. The History of the Business Budgeting to the Present: A Literature Review. Journal of Eastern Europe Research in Business and Economics. See: https://ibimapublishing.com/articles/JEERBE/2024/342438/342438.pdf.
World Economic Forum, 2025. “Global Cybersecurity Outlook 2025. See: https://reports.weforum.org/docs/WEF_Global_Cybersecurity_Outlook_2025.pdf.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Lawrence A. Gordon, Martin P. Loeb, Lei Zhou
This work is licensed under a Creative Commons Attribution 4.0 International License.
