ModelChoice decision tree · Cybersecurity

Cybersecurity Investment Decision

A full security suite, basic protection, insurance only, or accept the risk: which costs least overall?

Complexity: ★★★★★
Free Excel workbook
Needs ModelChoice: free trial

Download the Excel model Get the free ModelChoice trial

From the model’s decision tree

Lowest expected cost: Cyber Insurance Only

The expected value of each first option when every later decision is also made well (the tree rolled back).

First decision	Expected value
Full Security Suite	−$474,000
Basic Protection	−$346,200
Cyber Insurance Only	−$225,000	✔ best
Accept Risk (No Action)	−$720,000

Measure	Value
Expected value of the best strategy	−$225,000
Best outcome on the best strategy	−$80,000
Worst outcome on the best strategy	−$1,280,000

The best strategy: chance of each outcome or less

S-curve (cumulative probability) of Cyber Insurance Only from the saved simulation.

The decision

A mid-size financial services company (500 employees) must decide how much to invest in cybersecurity. Recent industry reports show that 60% of mid-size firms experience a significant cyber incident within any 2-year period. The CISO has presented four options to the board.

This is a loss-minimization problem: all outcomes are costs. The question is whether the upfront investment reduces expected losses enough to justify the spend.

Objective

Minimize expected total cost (investment + expected losses). This model shows why cybersecurity is an investment, not just an expense, and demonstrates the hidden costs of reactive vs. proactive approaches.

The options

Option 1: Full Security Suite ($450K): SIEM, EDR, zero-trust architecture, 24/7 SOC monitoring, employee training. Reduces breach probability to 10% and limits damage when breaches occur.
Option 2: Basic Protection ($120K): Firewall, antivirus, basic training. Moderate protection with reactive incident response. If an attack is detected, choose to hire an IR firm or handle internally. If ransomware hits, decide whether to pay or rebuild from backups.
Option 3: Cyber Insurance Only ($80K): Buy a cyber insurance policy with $2M coverage. No technical investment. Risk: 5% of claims are denied due to policy exclusions.
Option 4: Accept Risk (No Action): No security investment. High exposure: 55% chance of a significant attack. Catastrophic breach (10% of attacks) could cost $3M+.

The decision tree

The tree has 3 decisions, 8 chance events and 22 outcomes. The best path is open: at every decision the best choice is marked, and the expected value beside each branch counts every cash flow from the start. Open any other branch to see what follows it.

DecisionChance event+$ cash flow on the branch

Decision: Security Investment

Full Security Suite −$450,000expected −$474,000
Chance: Attack Scenario (Full Suite)
- 70% No Significant Attackpayoff −$450,000
- 20% Attack Blocked −$10,000payoff −$460,000
- 8% Breach (Limited) −$150,000payoff −$600,000
- 2% Major Breach −$500,000payoff −$950,000
Basic Protection −$120,000expected −$346,200
Chance: Attack Scenario (Basic)
- 60% No Significant Attackpayoff −$120,000
- 15% Attack Detected Lateexpected −$381,000
  Decision: Incident Response
  - Hire IR Firm −$100,000expected −$381,000 ✔ best
    Chance: IR Firm Outcome
    70% Contained Quickly −$80,000payoff −$300,000
    30% Partial Containment −$350,000payoff −$570,000
  - Handle Internallyexpected −$528,000
    Chance: Internal Response Outcome
    40% Contained −$120,000payoff −$240,000
    60% Escalates −$600,000payoff −$720,000
- 18% Data Breach −$800,000payoff −$920,000
- 7% Ransomwareexpected −$735,000
  Decision: Ransomware Response
  - Pay Ransom −$250,000expected −$850,000
    Chance: Ransom Payment Outcome
    60% Data Restored −$200,000payoff −$570,000
    40% Partial / Double Extortion −$900,000payoff −$1,270,000
  - Refuse & Rebuildexpected −$735,000 ✔ best
    Chance: Rebuild Outcome
    30% Fast Recovery −$300,000payoff −$420,000
    70% Slow Recovery −$750,000payoff −$870,000
Cyber Insurance Only −$80,000expected −$225,000 ✔ best
Chance: Attack Scenario (Insured)
- 55% No Significant Attackpayoff −$80,000
- 25% Breach (Covered) −$100,000payoff −$180,000
- 15% Breach (Partially Covered) −$400,000payoff −$480,000
- 5% Claim Denied −$1,200,000payoff −$1,280,000
Accept Risk (No Action)expected −$720,000
Chance: Attack Scenario (Unprotected)
- 45% No Significant Attackpayoff $0
- 30% Data Breach −$1,000,000payoff −$1,000,000
- 15% Ransomware −$800,000payoff −$800,000
- 10% Catastrophic Breach −$3,000,000payoff −$3,000,000

Change the numbers. Open the workbook with ModelChoice, change a probability or a cost in the tree, and the best decision updates at once.

Download the Excel model Get the free ModelChoice trial

Key assumptions

Assumption	Value	Notes
Full Security Suite Cost	$450,000	Annual: SIEM, EDR, SOC, training
Basic Protection Cost	$120,000	Firewall, AV, basic measures
Cyber Insurance Premium	$80,000	$2M coverage, $50K deductible
IR Firm Retainer	$100,000	Emergency incident response engagement
Ransom Demand	$250,000	Typical for mid-size firms
Catastrophic Breach Cost	$3,000,000	Regulatory fines, lawsuits, remediation
Attack Probability (No Protection)	55%	Industry average for mid-size firms
Attack Probability (Full Suite)	10%	Residual risk with best protection
Insurance Claim Denial Rate	5%	Policy exclusion risk

The figures are illustrative: the companies and numbers are invented for teaching.

Try it in ModelChoice

Strategy Table. Compare all protection strategies with risk-return frontier
Sensitivity Analysis. How does breach probability affect the optimal investment?
Risk Profile. Visualize the tail risk of catastrophic breaches

Find similar models

Related example models

All example models

An illustrative example: the figures are invented for teaching. Last updated 9 October 2026.