Cyber Risk Quantification and Security Portfolio Optimisation via Calibrated Monte Carlo Simulation

1. Introduction

The quantification of cyber risk remains one of the most pressing unsolved challenges in applied information security. Despite decades of technological advancement, cybersecurity decisions are still predominantly driven by qualitative heuristics, compliance checklists, or vendor assessments, rather than by formally grounded financial risk models [9,18,22]. This disparity between the financial gravity of cyber threats and the analytical tools available for their management has grown acute: the IBM Cost of a Data Breach Report 2024 records a global average breach cost of USD 4.88 million per incident, up 10% from the prior year [23], while the U.S. Federal Bureau of Investigation’s Internet Crime Complaint Center (IC3) reported total cybercrime losses exceeding USD 12.5 billion in 2023 [24]. Yet most organisations lack the methodological tools to convert these aggregate statistics into organisation-specific investment decisions.

The fundamental challenge is one of uncertainty quantification: cyber incidents are inherently stochastic events characterised by heavy-tailed loss distributions, infrequent but catastrophic tail scenarios, and non-stationary threat landscapes driven by adaptive adversaries. This constellation of properties makes deterministic or purely qualitative risk assessment inadequate. What is needed is a methodology that treats uncertainty not as a nuisance to be eliminated but as a structural feature to be modelled, quantified, and incorporated into investment logic [2,42].

Monte Carlo (MC) simulation offers a principled framework for this task: by drawing repeated samples from stochastic loss distributions, it generates an empirical distribution of aggregate financial outcomes from which coherent risk measures – Value at Risk (VaR), Conditional Value at Risk (CVaR), and Return on Investment (ROI) – can be estimated [29,42]. The approach has a long history in operational risk and actuarial science [26] and has been increasingly applied in cyber risk contexts [13,28,50].

Despite this promise, existing Monte Carlo-based cyber risk frameworks suffer from a critical limitation: they operate primarily on synthetic, user-defined parameters with no systematic methodology for extracting calibration values from real-world data. This makes their outputs illustrative at best and misleading at worst, since a precisely computed number derived from uncalibrated assumptions provides false precision rather than decision support [22,50].

The present paper addresses this gap by proposing a Compound Poisson–Triangular (CPT) Monte Carlo framework whose parameters are empirically calibrated from seven publicly available reference databases (Section 5). The framework produces actionable risk metrics for three representative organisational profiles and enables formal security portfolio optimisation under budget constraints.

The principal contributions of this paper are:

1.

A formally specified Compound Poisson–Triangular Monte Carlo model for cyber risk with multiplicative defence-portfolio mitigation factors and diminishing-returns properties (Section 3);

2.

A systematic calibration methodology linking model parameters to seven publicly available incident and cost databases, with bootstrap confidence intervals on all parameter estimates (Section 5);

3.

A formal analysis of CVaR as a coherent risk measure, including its superiority to VaR for portfolio optimisation, and the derivation of Monte Carlo estimator confidence intervals (Section 4);

4.

A CVaR-minimization security portfolio optimisation formulation and an efficient frontier analysis under varying budget constraints (Section 6);

5.

Numerical experiments for three organisational profiles (healthcare, financial services, manufacturing) with calibrated parameters, sensitivity analysis, and comparison with the Gordon–Loeb (GL) analytical model (Section 7);

6.

A discussion of methodological limitations, including non-stationarity, under-reporting bias, and distribution robustness, with directions for future research (Section 8).

2. Related Work

2.1. Economic Models of Cybersecurity Investment

The foundational economic analysis of cybersecurity investment was established by Gordon and Loeb [18], who proved that the optimal investment in information security is generally no greater than $1/e\approx 37\%$ of the expected loss from a security breach. Their model provides an analytical upper bound that serves as the primary benchmark in literature and against which the present framework is compared in Section 7. Extensions of the Gordon–Loeb model include multi-period and competitive settings [19,46], as well as applications to specific sectors. Cavusoglu et al. [6] developed a decision-analytic model for IT security investment incorporating game-theoretic attacker behavior.

2.2. Quantitative Cyber Risk Frameworks

The Factor Analysis of Information Risk (FAIR) framework [16] provides the leading industry standard for quantitative cyber risk in financial terms. FAIR decomposes risk into Threat Event Frequency and Loss Magnitude, both of which can be modelled as stochastic quantities. The present framework extends the FAIR conceptual decomposition by providing a formal probabilistic model (Compound Poisson–Triangular) and a calibration methodology from public data, elements that FAIR describes conceptually but does not operationalise in closed form.

2.3. Stochastic and Actuarial Approaches

Actuarial compound Poisson models for aggregate cyber loss have been studied extensively in the context of cyber insurance [3,5,13]. Maillart and Sornette [28] demonstrated that cyber loss distributions exhibit heavy tails consistent with power-law behaviour, motivating the use of distributions with unbounded support (lognormal, Generalised Pareto) rather than bounded approximations such as the triangular distribution. Romanosky [43] provided an empirical analysis of data breach costs using a comprehensive proprietary dataset, finding high variability and heavy skewness in breach costs. Eling and Schnell [13] and Cremer et al. [9] provide comprehensive surveys of cyber risk modelling and data availability.

2.4. Monte Carlo Methods in Cyber Risk

Monte Carlo simulation for cyber risk has been applied in contexts ranging from network vulnerability assessment to financial quantification [17,50]. Woods and Böhme [50] provide a systematic overview of quantitative cyber risk methods, identifying the calibration of stochastic parameters as the primary obstacle to practical deployment. Fielder et al. [17] applied Monte Carlo methods to security investment decision support, finding that quantitative approaches significantly outperform heuristic methods in resource allocation efficiency. Marotta et al. [30] review cyber insurance and risk assessment literature, highlighting the need for validated empirical calibration.

2.5. Tail Risk Measures in Cyber Security

The application of financial risk measures – in particular VaR and CVaR – to cyber security contexts has been advocated by multiple authors [2,42]. Artzner et al. [2] established the axiomatic framework for coherent risk measures, proving that CVaR (Expected Shortfall) is coherent while VaR is not. This distinction is practically important in the portfolio optimisation context, since CVaR minimisation is a convex optimisation problem amenable to standard solvers, while VaR minimisation is in general NP-hard [42].

2.6. Gap Addressed by the Present Work

The existing literature provides: (i) analytical models (Gordon–Loeb, FAIR) that are tractable but lack simulation richness; or (ii) simulation models that are rich but inadequately calibrated. The present work bridges this gap by combining a formally specified simulation engine with a systematic public-data calibration methodology and a CVaR portfolio optimisation layer, while benchmarking against the Gordon–Loeb model.

3. Mathematical Framework

3.1. Compound Poisson–Triangular Loss Model

Let a time window of length T years be given. Following standard practice in actuarial compound-loss modelling [26], the number of cyber incidents K occurring within $[0,T]$ is modelled as a Poisson random variable:

$$K\sim \mathrm{Poisson}\left({\lambda }_0·T·(1-R_{\mathrm{freq}})\right),$$

(1)

where ${\lambda }_0>0$ is the baseline annual incident rate (calibrated from public databases per Section 5), and $R_{\mathrm{freq}}\in [0,1)$ is the frequency mitigation factor of the deployed defence portfolio.

The financial loss $L_j$ associated with the j-th incident is modelled as a triangular random variable, a bounded three-parameter proxy widely used for expert-elicited or data-scarce severity distributions [25]:

$$L_j\sim \mathrm{Triangular}(l_{min},l_{\mathrm{mode}},l_{max}),j=1,\dots ,K,$$

(2)

with $0<l_{min}\le l_{\mathrm{mode}}\le l_{max}$. The portfolio-adjusted loss per incident is:

$$L_j^{\prime }=L_j·(1-R_{\mathrm{sev}}),$$

(3)

where $R_{\mathrm{sev}}\in [0,1)$ is the severity mitigation factor. By the i.i.d. property established above, the portfolio-adjusted losses $L_j^{\prime }=L_j·(1-R_{\mathrm{sev}})$ are likewise i.i.d.; their common distribution is that of $L^{\prime }=L·(1-R_{\mathrm{sev}})$, independent of K. The aggregate annual loss is:

$$S={\displaystyle \sum _{j=1}^K}{L}_j^{\prime }.$$

(4)

The right-hand side of (2) does not depend on j by design: the modelling assumption is that all incidents are statistically homogeneous, i.e., each $L_j$ is an independent draw from the same distribution regardless of the order in which the incident occurs. The variables $L_1,\dots ,L_K$ are therefore independent and identically distributed (i.i.d. - apparently a severe limitation debated in Section 8.2). A generic representative copy is further denoted

$$L\sim \mathrm{Triangular}(l_{min},l_{\mathrm{mode}},l_{max}),$$

(5)

and used here and in the moment formulas of Section 3.3. By the Wald identity for compound distributions [26], the first and the second moments (the mean and variance) of the aggregate annual loss S are:

$$\begin{array}{cc}\hfill \mathbb{E}\left[S\right]& =\mathbb{E}\left[K\right]·\mathbb{E}\left[L^{\prime }\right]\hfill \end{array}$$

(6)

$$\begin{array}{cc}\hfill \mathrm{Var}\left(S\right)& =\mathbb{E}\left[K\right]·\mathrm{Var}\left(L^{\prime }\right)+\mathrm{Var}\left(K\right)·{\left(\mathbb{E}\left[L^{\prime }\right]\right)}^2.\hfill \end{array}$$

(7)

and since $K\sim \mathrm{Poisson}\left(\mu \right)$, the first two moments of K are equal and expressed as:

$$\mathbb{E}\left[K\right]=\mathrm{Var}\left(K\right)=\mu ={\lambda }_{0}T(1-R_{\mathrm{freq}}).$$

(8)

For the triangular distribution with parameters $(a,c,b)$, the first and the second moments are:

$$\mathbb{E}\left[L\right]=(a+c+b)/3$$

(9)

and

$$\mathrm{Var}\left(L\right)=(a^2+c^2+b^2-ab-ac-bc)/18.$$

(10)

3.2. Defence Portfolio Mitigation Model

Given a defence portfolio consisting of n security measures, each measure i exerts a fractional reduction $r_{i,f}\in [0,1)$ on incident frequency and $r_{i,s}\in [0,1)$ on loss severity. Assuming independence of control effects (a conservative approximation, and an apparently severe limitation for which the counter-arguments are delivered here in Section 8.2), the composite mitigation factors are:

$$\begin{array}{cc}\hfill R_{\mathrm{freq}}& =1-{\displaystyle \prod _{i=1}^n}(1-r_{i,f}),\hfill \end{array}$$

(11)

$$\begin{array}{cc}\hfill R_{\mathrm{sev}}& =1-{\displaystyle \prod _{i=1}^n}(1-r_{i,s}).\hfill \end{array}$$

(12)

This multiplicative structure ensures that $R_{\mathrm{freq}},R_{\mathrm{sev}}<1$ for any finite portfolio, thereby correctly modelling diminishing returns: each additional measure reduces only the residual risk, not the total risk.

Remark 1.

The independence assumption in (11), (12) is - again - conservative. In practice, controls may have synergistic effects. An upper bound on $R_{\mathrm{freq}}$ under positive control correlation can be obtained by treating $r_{i,f}$ as dependent random variables with known covariance structure [17]. However, a balanced view between the apparent limitation and the counter-arguments is presented in Section 8.2).

3.3. Financial Risk Metrics

Let $N\in \mathbb{N}$ denote the number of Monte Carlo scenarios, and let $\{S^{\left(1\right)},\dots ,S^{\left(N\right)}\}$ be N independent realizations of the aggregate annual loss S defined in (4). Denote by

$$F_S\left(x\right)=\mathbb{P}(S\le x)$$

(13)

the true (population) cumulative distribution function of S, and by

$${\widehat{F}}_S\left(x\right)=N^{-1}{\displaystyle \sum _{i=1}^N}\mathbf{1}[S^{\left(i\right)}\le x]$$

(14)

its empirical counterpart. The following population quantities and their Monte Carlo estimators are used throughout the paper.

Definition 1

(Expected Loss). The population expected loss is:

$$\mathrm{EL}=\mathbb{E}\left[S\right]=\mathbb{E}\left[K\right]·\mathbb{E}\left[L^{\prime }\right],$$

(15)

by the Wald identity – see equation (6). Its Monte Carlo estimator is:

$$\widehat{\mathrm{EL}}=N^{-1}{\displaystyle \sum _{i=1}^N}{S}^{\left(i\right)}\stackrel{a.s.}{\to }\mathrm{EL}(N\to \infty ),$$

(16)

where a.s. convergenge is almost sure when N goes to infinity, and $N^{-1}$ is the arithmetic reciprocal of N - to avoid any confusion.

Definition 2

(Value at Risk). For $\alpha \in (0,1)$, the population Value at Risk is the α-quantile of $F_S$:

$${\mathrm{VaR}}_{\alpha }=F_S^{-1}\left(\alpha \right)=inf\left\{x\in \mathbb{R}:F_S\left(x\right)\ge \alpha \right\}.$$

(17)

Here $F_S^{-1}$ denotes the generalised inverse (quantile function) of $F_S$, defined as the infimum of the preimage $\{x:F_S\left(x\right)\ge \alpha \}$. It coincides with the ordinary functional inverse when $F_S$ is strictly increasing and continuous, and is not the arithmetic reciprocal $1/F_S$ - to be clear. Its Monte Carlo estimator is:

$${\widehat{\mathrm{VaR}}}_{\alpha }={\widehat{F}}_S^{-1}\left(\alpha \right),$$

(18)

the quantile function of the empirical distribution ${\widehat{F}}_S$, with ${\widehat{F}}_S^{-1}$ carrying the same generalised-inverse meaning.

Definition 3

(Conditional Value at Risk). The population Conditional Value at Risk (CVaR), also known as Expected Shortfall, is:

$${\mathrm{CVaR}}_{\alpha }=\mathbb{E}[S\mid S>{\mathrm{VaR}}_{\alpha }].$$

(19)

Its Monte Carlo estimator replaces the population threshold ${\mathrm{VaR}}_{\alpha }$ with ${\widehat{\mathrm{VaR}}}_{\alpha }$ and the conditional expectation with the sample mean over tail observations:

$${\widehat{\mathrm{CVaR}}}_{\alpha }={\displaystyle \frac{1}{\lfloor N(1-\alpha )\rfloor }}\sum _{i:S^{\left(i\right)}>{\widehat{\mathrm{VaR}}}_{\alpha }}{S}^{\left(i\right)}\stackrel{a.s.}{\to }{\mathrm{CVaR}}_{\alpha }(N\to \infty ).$$

(20)

Definition 4

(Return on Investment).

$$\mathrm{ROI}={\displaystyle \frac{{\widehat{\mathrm{EL}}}_{\mathrm{base}}-{\widehat{\mathrm{EL}}}_{\mathrm{prot}}-C_{\sec }}{C_{\sec }}},$$

(21)

where ${\widehat{\mathrm{EL}}}_{\mathrm{base}}$ and ${\widehat{\mathrm{EL}}}_{\mathrm{prot}}$ are the Monte Carlo estimates of the expected annual loss in the unprotected baseline scenario and in the portfolio-protected scenario (see (4), (6)), respectively, and $C_{\sec }$ is the annual security investment cost of the deployed portfolio.

Definition 5

(Payback Period). The payback period is the smallest $t^{*}>0$ such that:

$$\left({\widehat{\mathrm{EL}}}_{\mathrm{base}}-{\widehat{\mathrm{EL}}}_{\mathrm{prot}}\right)·t^{*}\ge C_{\sec },$$

(22)

i.e., the time at which the cumulative avoided losses recover the security investment cost.

4. Coherent Risk Measures and the Superiority of CVaR

4.1. Axiomatic Framework

A risk measure $\rho :{\mathcal{L}}^2\to \mathbb{R}$ is coherent in the sense of Artzner et al. [2] if it satisfies the following four axioms, where $X,Y\in {\mathcal{L}}^2$:

(i).

Monotonicity:

$$X\le Y\Rightarrow \rho \left(X\right)\le \rho \left(Y\right).$$

(23)

(ii).

Translation Invariance: for all $c\in \mathbb{R}$,

$$\rho (X+c)=\rho \left(X\right)+c.$$

(24)

(iii).

Positive Homogeneity: for all $\lambda >0$,

$$\rho \left(\lambda X\right)=\lambda \rho \left(X\right).$$

(25)

(iv).

Sub-Additivity:

$$\rho (X+Y)\le \rho \left(X\right)+\rho \left(Y\right).$$

(26)

VaR satisfies (23)–(25) but violates sub-additivity (26) in general: there exist random variables $X,Y$ such that:

$${\mathrm{VaR}}_{\alpha }(X+Y)>{\mathrm{VaR}}_{\alpha }\left(X\right)+{\mathrm{VaR}}_{\alpha }\left(Y\right),$$

(27)

implying that VaR can increase when risks are combined – an economically unacceptable property for portfolio optimisation. CVaR satisfies all four above conditions (23)–(26) and additionally is a convex function of the portfolio composition, enabling gradient-based optimisation [42].

4.2. Monte Carlo Estimation and Confidence Intervals

Let

$$f_S\left(x\right)=F_S^{\prime }\left(x\right)$$

(28)

denote the probability density function (PDF) of the aggregate loss S, i.e., the derivative of the CDF  $F_S$ introduced in Section 3, equation (13).

For N independent replications ${\left\{S^{\left(i\right)}\right\}}_{i=1}^N$, the Monte Carlo estimator ${\widehat{\mathrm{VaR}}}_{\alpha }$ has the following asymptotic distribution [26]:

$$\sqrt{N}\left({\widehat{\mathrm{VaR}}}_{\alpha }-{\mathrm{VaR}}_{\alpha }\right)\stackrel{d}{\to }\mathcal{N}\left(0,{\displaystyle \frac{\alpha (1-\alpha )}{f_S{\left({\mathrm{VaR}}_{\alpha }\right)}^2}}\right).$$

(29)

where the symbol $\stackrel{d}{\to }$ denotes convergence in distribution as $N\to \infty$.

Formula (29) is the classical asymptotic normality result for sample quantiles, applied here to the empirical distribution of the simulated aggregate losses $\left\{S^{\left(i\right)}\right\}$. Each component carries a precise interpretation:

• $\sqrt{N}({\widehat{\mathrm{VaR}}}_{\alpha }-{\mathrm{VaR}}_{\alpha })$: the estimation error ${\widehat{\mathrm{VaR}}}_{\alpha }-{\mathrm{VaR}}_{\alpha }$ converges to zero at rate $1/\sqrt{N}$; multiplying by $\sqrt{N}$ rescales it to a non-degenerate limit. This confirms that the Monte Carlo estimator ${\widehat{\mathrm{VaR}}}_{\alpha }$ is consistent, i.e.

  $${\widehat{\mathrm{VaR}}}_{\alpha }\stackrel{a.s.}{\to }{\mathrm{VaR}}_{\alpha }$$

  (30)

  and that its precision improves as $O\left(N^{-1/2}\right)$.
• $\mathcal{N}(0,·)$: tells that the rescaled error is asymptotically unbiased (mean zero) and normally distributed, enabling the construction of symmetric Confidence Intervals.
• $\alpha (1-\alpha )$ in is precisely the variance of a Bernoulli$\left(\alpha \right)$ indicator (a random Bernoulli variable with parameter $\alpha$ , arising because the event $\{S^{\left(i\right)}\le {\mathrm{VaR}}_{\alpha }\}$ has probability exactly $\alpha$ under the true distribution $F_S$, while the complementary event $\{S^{\left(i\right)}>{\mathrm{VaR}}_{\alpha }\}$ has exactly the complementary probability $1-\alpha$. The product $\alpha (1-\alpha )$ reaches its maximum at $\alpha =0.5$ and decreases toward zero as $\alpha \to 0$ or $\alpha \to 1$, reflecting that extreme quantiles require proportionally fewer observations on one side of the threshold.
• $f_S{\left({\mathrm{VaR}}_{\alpha }\right)}^2$ in the denominator: the squared PDF evaluated at the true VaR controls how sharply $F_S$ rises at the threshold. A high density (steep CDF) means that small shifts in probability correspond to small shifts in the quantile value, yielding precise estimation; conversely, a low density (flat CDF near ${\mathrm{VaR}}_{\alpha }$) implies high sensitivity of the quantile to sampling noise. For compound Poisson models with large $\mathbb{P}(S=0)$, the density $f_S\left({\mathrm{VaR}}_{\alpha }\right)$ at the right tail can be small, increasing estimation uncertainty at high confidence levels.
• Practical implication: for $\alpha =0.95$ and $N=200,000$, the half-width of the $95\%$ confidence interval is proportional to $1.96\sqrt{0.95\times 0.05/N}/f_S\left({\mathrm{VaR}}_{0.95}\right)$, which is small provided $f_S\left({\mathrm{VaR}}_{0.95}\right)$ is bounded away from zero.

From (29), a $95\%$ Confidence Interval for ${\mathrm{VaR}}_{\alpha }$ is:

$${\widehat{\mathrm{VaR}}}_{\alpha }\pm {\displaystyle \frac{1.96\sqrt{\alpha (1-\alpha )/N}}{{\widehat{f}}_S\left({\widehat{\mathrm{VaR}}}_{\alpha }\right)}},$$

(31)

where ${\widehat{f}}_S$ is a kernel density estimator [47] of $f_S$ evaluated at ${\widehat{\mathrm{VaR}}}_{\alpha }$.

For ${\mathrm{CVaR}}_{\alpha }$, no closed-form asymptotic formula analogous to (29) is available in general, so a nonparametric bootstrap confidence interval [12] is used instead: resample $B=1000$ bootstrap samples ${\left\{S^{(i,b)}\right\}}_{i=1}^N$, $b=1,\dots ,B$, from the original draws ${\left\{S^{\left(i\right)}\right\}}_{i=1}^N$; compute ${\widehat{\mathrm{CVaR}}}_{\alpha }^{*\left(b\right)}$ for each replicate b; and take the $2.5$th and $97.5$th empirical percentiles of ${\left\{{\widehat{\mathrm{CVaR}}}_{\alpha }^{*\left(b\right)}\right\}}_{b=1}^B$ as interval endpoints. For $\alpha$ close to 1, reliable CVaR estimation requires $N\ge 100,000$ Monte Carlo draws so that a sufficient number of tail observations is available [42].

5. Empirical Calibration from Public Databases

5.1. Public Reference Databases

The CPT model parameters $({\lambda }_0,l_{min},l_{\mathrm{mode}},l_{max})$ and the mitigation factors $(r_{i,f},r_{i,s})$ are calibrated from the following publicly available sources:

1.

Verizon DBIR 2024 [48]: Annual incident frequency statistics per industry sector, attack pattern, and actor category. Primary source for ${\lambda }_0$ stratified by sector.

2.

IBM Cost of a Data Breach Report 2024 [23]: Total breach cost distributions by industry, attack vector, and regulatory context. Primary source for $l_{\mathrm{mode}}$ and $l_{max}$ of the severity distribution.

3.

FBI IC3 Annual Report 2023 [24]: Financial losses from cybercrime by category, victim count, and geographic distribution. Used for cross-validation of severity parameters and SMEs (small and medium enterprises) loss estimates.

4.

ENISA Threat Landscape 2024 [15]: Threat frequency trends and impact statistics for European organisations. Used for EU-specific ${\lambda }_0$ calibration and regulatory cost estimation under NIS2 (Network and Information Systems Directive 2, [36]).

5.

NIST National Vulnerability Database (NVD) [37]: Annual CVE (Common Vulnerabilities and Exposures) publication counts and CVSS (Common Vulnerability Scoring System) severity distributions. Used as a proxy for the exploitable vulnerability surface.

6.

CISA Known Exploited Vulnerabilities (KEV) Catalog [7]: Subset of NVD dataset comprising only the actively exploited vulnerabilities. Used to calibrate operationally relevant ${\lambda }_0$.

7.

Ponemon Institute Cost of Cybercrime Study 2024 [40]: Sectoral cybercrime cost breakdowns and incident response cost data. Used to calibrate $l_{min}$ and recovery cost components.

5.2. Frequency Parameter Calibration

From Verizon DBIR 2024 [48], incident rates per 1,000 organisations per year are extracted for each sector. The maximum likelihood estimator (MLE) of the Poisson rate is:

$${\widehat{\lambda }}_0={\displaystyle \frac{(\mathrm{reported}\mathrm{incidents}\mathrm{in}\sec \mathrm{tor})}{(\mathrm{estimated}\mathrm{number}\mathrm{of}\mathrm{organisations})\times T}}.$$

(32)

A correction factor $\kappa >1$ is applied to account for the systematic under-reporting of cyber incidents, estimated from the ratio of IC3-reported incidents to DBIR-reported incidents for comparable categories [9,24]. Bootstrap $95\%$ confidence intervals [12] on ${\widehat{\lambda }}_0$ are computed by resampling the DBIR incident counts under a Poisson assumption.

Table 1 shows calibrated ${\widehat{\lambda }}_0$ values for three representative organisational profiles, with $95\%$ confidence intervals.

5.3. Severity Distribution Calibration

Loss severity parameters are calibrated from IBM Cost of a Data Breach 2024 [23] and IC3 2023 [24]. The triangular distribution parameters $(l_{min},l_{\mathrm{mode}},l_{max})$ are set as follows: $l_{\mathrm{mode}}$ is set to the industry-specific average cost from IBM; $l_{min}$ is set to the 10th percentile estimated from IC3 small-incident data; $l_{max}$ is set to the 95th percentile of the IBM cost distribution for that sector. For the healthcare sector, IBM 2024 reports an average breach cost of USD 9.77 million, the highest of any sector [23], giving (in million USD):

$$(l_{min},l_{\mathrm{mode}},l_{max})=(0.38,9.77,32.0).$$

(33)

Remark 2

(Derivation of ${\mathrm{EL}}_{\mathrm{base}}$). The expected annual loss per organisation (in a certain sector s) is aderivedquantity calculated as:

$${\mathrm{EL}}_{\mathrm{base}}^{\left(s\right)}={\lambda }_0^{\left(s\right)}·\mathbb{E}\left[L^{\left(s\right)}\right]={\lambda }_0^{\left(s\right)}·{\displaystyle \frac{l_{min}^{\left(s\right)}+l_{\mathrm{mode}}^{\left(s\right)}+l_{max}^{\left(s\right)}}{3}},$$

(34)

where ${\lambda }_0^{\left(s\right)}$ is from Table 1 and $l_{\mathrm{mode}}^{\left(s\right)}$ is the industry-average breach cost from IBM CODB 2024 [23] (IBM Cost of a Data Breach). Evaluating formula (34) accordingly to the values in Table 1 and Table 2 results in the following ${\mathrm{EL}}_{\mathrm{base}}^{\left(s\right)}$ sector–specific values for Healthcare:

$${\mathrm{EL}}_{\mathrm{base}}^{\left(H\right)}=0.31\times 14.05=4.36M\$,$$

(35)

Financial:

$${\mathrm{EL}}_{\mathrm{base}}^{\left(F\right)}=0.19\times 8.83=1.68M\$,$$

(36)

and Manufacturing:

$${\mathrm{EL}}_{\mathrm{base}}^{\left(M\right)}=0.14\times 7.71=1.08M\$,$$

(37)

with s indexing the sector (Healthcare, Financial, Manufacturing):

$$s\in \{H,F,M\}.$$

(38)

These values are cross-validated against the Ponemon Cost of Cybercrime 2024 study for medium organisations (250–2 000 employees). The model is parameterised for this organisational size profile: regional hospital (Healthcare), regional bank or mid-size insurer (Financial), discrete manufacturer 500–2 000 employees (Manufacturing).

Table 2. Calibrated triangular severity parameters (million USD) by sector, derived from IBM 2024 [23], IC3 2023 [24], and Ponemon 2024 [40].

Sector	$l_{min}$	$l_{\mathbf{mode}}$	$l_{max}$	$\mathbb{E}\left[L\right]$
Healthcare	0.38	9.77	32.0	14.05
Financial Svc	0.30	6.08	20.1	8.83
Manufacturing	0.18	5.56	17.39	7.71

Table 2. Calibrated triangular severity parameters (million USD) by sector, derived from IBM 2024 [23], IC3 2023 [24], and Ponemon 2024 [40].

Sector	$l_{min}$	$l_{\mathbf{mode}}$	$l_{max}$	$\mathbb{E}\left[L\right]$
Healthcare	0.38	9.77	32.0	14.05
Financial Svc	0.30	6.08	20.1	8.83
Manufacturing	0.18	5.56	17.39	7.71

5.4. Mitigation Factor Calibration

Control effectiveness estimates $(r_{i,f},r_{i,s})$ for each security measure are derived from the CIS Critical Security Controls v8 safeguard catalogue [8], cross-referenced against the NIST guidance it is commonly mapped to [34,35], Verizon DBIR 2024 control analysis [48], and the MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework mitigations [32]. Table 3 summarises the calibrated mitigation factors for the five controls considered in the experiments.

6. Portfolio Optimisation

6.1. CVaR-Minimization Formulation

Given a set $\mathcal{M}=\{1,\dots ,n\}$ of available security controls with sector-specific mitigation factors (as in Table 3), costs $c_i$, and sector-specific annual budgets $B_s$, three portfolio selection modes are evaluated:

Mode 1 selects the best portfolio with at most two controls:

$$\begin{array}{cc}\hfill \underset{{\mathbf{x}:\parallel \mathbf{x}\parallel }_1\le 2,{\mathbf{c}}^{\top }\mathbf{x}\le B_s}{min}& \widehat{\mathrm{EL}}(\mathbf{x},s).\hfill \end{array}$$

(39)

Mode 2 adds controls greedily (maximum $\Delta \mathrm{EL}$) while the marginal reduction exceeds threshold $\tau$:

$$\Delta {\mathrm{EL}}_{\mathrm{marg}}\ge \tau ·{\mathrm{EL}}_{\mathrm{base}}^{\left(s\right)},\tau \in \{16\%,8\%,4\%,2\%,1\%\},$$

(40)

subject to ${\mathbf{c}}^{\top }\mathbf{x}\le B_s$, where $\Delta {\mathrm{EL}}_{\mathrm{marg}}$ represents the marginal reduction in Expected Annual Loss achieved by adding a security control to an existing portfolio:

$$\Delta {\mathrm{EL}}_{\mathrm{marg}}=E{L}_{before}-E{L}_{after}$$

(41)

The family of portfolios indexed by $\tau$ traces a risk-reduction efficient frontier (Table 5).

Mode 3 adds controls greedily by cost-efficiency ratio $\Delta \mathrm{EL}/c_i$ and stops when that ratio drops to less than 10% of the first step’s ratio:

$${\displaystyle \frac{\Delta {\mathrm{EL}}_{\mathrm{marg}}}{c_{\mathrm{next}}}}<0.10·{\displaystyle \frac{\Delta {\mathrm{EL}}_1}{c_1}},$$

(42)

subject to ${\mathbf{c}}^{\top }\mathbf{x}\le B_s$. This criterion identifies the “knee” of the cost-efficiency curve. Sector-specific budgets are derived as a fraction of the Gordon–Loeb bound (Section 6.2): $B_{\mathrm{HC}}=B_{\mathrm{Fin}}=100$ k$ and $B_{\mathrm{Man}}=75$ k$. Since $n=5$ and $2^5=32$, exhaustive enumeration over all subsets is performed in milliseconds for Modes 1 and 2; Mode 3 uses the greedy criterion, which is also $O\left(n^2\right)$.

Remark 3.

Because CVaR is a coherent and convex risk measure, the relaxed continuous-variable version of (39) is a convex program solvable in polynomial time [42]. The integrality constraint (40) makes the problem NP-hard in the worst case but tractable for $n\le 20$ ($2^{20}\approx {10}^6$ subsets).

6.2. Comparison with the Gordon–Loeb Model

In Gordon–Loeb model [18], the optimal security investment $z^{*}$ satisfies:

$$z^{*}\le {\displaystyle \frac{v·p\left(z^{*}\right)}{e}},$$

(43)

where v is the asset value at risk, $p\left(z\right)$ is the probability of a security breach as a function of investment z, and $e\approx 2.718\dots$ is Euler’s constant. This bound implies that rational security investment never exceeds $1/e\approx 37\%$ of the expected loss from a breach.

For comparison, we compute the Gordon–Loeb upper bound for each organisational profile using the calibrated ${\widehat{\lambda }}_0$ and $\mathbb{E}\left[L\right]$ from Table 1 and Table 2, with

$$v=\mathbb{E}\left[L\right]$$

(44)

and

$$p\left(0\right)=1-e^{-{\widehat{\lambda }}_{0}T}.$$

(45)

The comparison (Table 6) shows that the CPT optimal portfolio costs are within the Gordon–Loeb bound for all three profiles, validating the economic consistency of the proposed framework.

7. Numerical Experiments

7.1. Experimental Setup

7.1.0.1. Simulation parameters:

For each organisational profile, $N=200,000$ Monte Carlo iterations are executed with fixed seed = 42 for full reproducibility, over a time horizon of $T=1$ year at confidence level $\alpha =0.95$. All computations are implemented in the companion Python framework ccptmcs_framework.py using NumPy vectorised operations (compound Poisson simulation via np.bincount, $O(N+M)$ time and space complexity where $M={\sum }_{i=1}^N{K}_i$).

Organisational profiles and calibrated parameters:

Three medium-scale organisational profiles are instantiated from the empirical calibration of Section 5 (Table 1, Table 2 and Table 3):

• Healthcare (${\widehat{\lambda }}_0=0.31$, $T(0.38,9.77,32.0)$ M$, ${\mathrm{EL}}_{\mathrm{base}}=4.36$ M$): regional hospital, primary threat vectors ransomware and privilege misuse [48].
• Financial services (${\widehat{\lambda }}_0=0.19$, $T(0.30,6.08,20.1)$ M$, ${\mathrm{EL}}_{\mathrm{base}}=1.68$ M$): regional bank or mid-size insurer, primary vectors social engineering and malware [48]. Severity parameters updated to IBM CODB 2024: $l_{min}$ and $l_{max}$ scaled by factor $6.08/5.90=1.031$ ($+3.1\%$ vs. 2023); $l_{\mathrm{mode}}=6.08$ M$ was already the 2024 value.
• Manufacturing (${\widehat{\lambda }}_0=0.14$, $T(0.18,5.56,17.39)$ M$, ${\mathrm{EL}}_{\mathrm{base}}=1.08$ M$): discrete manufacturer, primary vectors supply-chain compromise and ransomware; severity parameters updated to IBM CODB 2024 [23] ($l_{\mathrm{mode}}=5.56$ M$, $+18\%$ vs. 2023).

The sector–specific expected annual loss ${\mathrm{EL}}_{\mathrm{base}}^{\left(s\right)}$ is derived via (34). Security control effectiveness is drawn from the sector-specific Table 3, calibrated from DBIR 2024 attack-technique frequencies and MITRE ATT&CK mitigation mappings (Section 5).

Three portfolio modes and sector-specific budgets:

For each of the three sectors, four scenarios are evaluated (a Baseline case defined below, and another three cases corresponding to optimization modes (1-3) defined in Section 6.1:

• Baseline: no security controls ($\mathbf{x}=\mathbf{0}$, $S=S_{\mathrm{base}}$).
• Mode 1: best portfolio with at most 2 controls, budget-constrained by (39).
• Mode 2: greedy portfolio selection, with marginal reduction criteria in  (40) and  (41).
• Mode 3: greedy (cost-efficiency ratio) portfolio, with stopping criterion (42).

Table 4 reports the Baseline, Mode 1 and Mode 3, while Table 5 reports the Mode 2 efficient frontier (40) for

$$\tau \in \{16\%,8\%,4\%,2\%,1\%\}.$$

(46)

Sector-specific annual security budgets are $B_{\mathrm{HC}}=B_{\mathrm{Fin}}=100$ k$ and $B_{\mathrm{Man}}=75$ k$, representing respectively 7.3%, 17.8%, and 20.2% of the corresponding Gordon–Loeb upper bounds (Table 6), all within the economically rational investment range identified by Gordon and Loeb [18].

7.2. Results: Risk Metric Comparison

Table 4 presents the key risk metrics for the Baseline and two optimized scenarios (Mode 1 and Mode 3) for each organisational profile, computed at confidence level $\alpha =0.95$.

Table 4. Monte Carlo risk metrics ($N=200,000$, $\alpha =0.95$, $T=1$ yr, seed = 42). Sector-specific budgets: $B_{\mathrm{HC}}=B_{\mathrm{Fin}}=100$ k$, $B_{\mathrm{Man}}=75$ k$. Values in million USD; 95% confidence interval for CVaR via bootstrap.

Sector	Scenario	EL	VaR0.95	CVaR0.95	ROI	Payback
	Baseline	4.36	23.6	30.9	–	–
Healthcare	Mode $1^1$	0.90	6.5	8.7	51.7	0.2 mo
	Mode 32	0.37	3.6	5.6	41.1	0.3 mo
	Baseline	1.68	12.0	16.1	–	–
Financial	Mode 13	0.33	3.1	5.9	21.4	0.6 mo
	Mode 34	0.32	3.0	5.3	26.2	0.5 mo
	Baseline	1.08	9.0	12.7	–	–
Manufacture	Mode 15	0.15	1.4	2.4	13.9	0.9 mo
	Mode 36	0.15	1.4	2.4	13.9	0.9 mo

Table 4. Monte Carlo risk metrics ($N=200,000$, $\alpha =0.95$, $T=1$ yr, seed = 42). Sector-specific budgets: $B_{\mathrm{HC}}=B_{\mathrm{Fin}}=100$ k$, $B_{\mathrm{Man}}=75$ k$. Values in million USD; 95% confidence interval for CVaR via bootstrap.

Sector	Scenario	EL	VaR0.95	CVaR0.95	ROI	Payback
	Baseline	4.36	23.6	30.9	–	–
Healthcare	Mode $1^1$	0.90	6.5	8.7	51.7	0.2 mo
	Mode 32	0.37	3.6	5.6	41.1	0.3 mo
	Baseline	1.68	12.0	16.1	–	–
Financial	Mode 13	0.33	3.1	5.9	21.4	0.6 mo
	Mode 34	0.32	3.0	5.3	26.2	0.5 mo
	Baseline	1.08	9.0	12.7	–	–
Manufacture	Mode 15	0.15	1.4	2.4	13.9	0.9 mo
	Mode 36	0.15	1.4	2.4	13.9	0.9 mo

The controls and prices of the above mentioned Mode 1 and Mode 3 scenarios are: ¹ (EDR+Bkp, 67 k$); ² (MFA+Bkp+Trn+EDR, 97 k$); ³ (MFA+EDR, 63 k$); ⁴ (Trn+MFA+Bkp, 52 k$); ⁵ (EDR+Bkp, 67 k$); ⁶ (Bkp+EDR, 67 k$).

Table 5. Mode 2 efficient frontier: greedy $\Delta$EL portfolios for decreasing marginal threshold $\tau$ (% of ${\mathrm{EL}}_{\mathrm{base}}$). Each row shows the portfolio selected when the threshold changes. Budget constraints as in Table 4.

Sector	$\tau$	Portfolio	k	Cost	EL prot
	16%	EDR+Backup	2	67 k$	0.90 M$
Healthcare	8%	EDR+Backup+MFA	3	85 k$	0.50 M$
	2%	EDR+Backup+MFA+Training	4	97 k$	0.37 M$
	16%	EDR+MFA	2	63 k$	0.33 M$
Financial	8%	EDR+MFA+Backup	3	85 k$	0.19 M$
	2%	EDR+MFA+Backup+Training	4	97 k$	0.12 M$
Manufacturing	all	EDR+Backup	2	67 k$	0.15 M$

Table 5. Mode 2 efficient frontier: greedy $\Delta$EL portfolios for decreasing marginal threshold $\tau$ (% of ${\mathrm{EL}}_{\mathrm{base}}$). Each row shows the portfolio selected when the threshold changes. Budget constraints as in Table 4.

Sector	$\tau$	Portfolio	k	Cost	EL prot
	16%	EDR+Backup	2	67 k$	0.90 M$
Healthcare	8%	EDR+Backup+MFA	3	85 k$	0.50 M$
	2%	EDR+Backup+MFA+Training	4	97 k$	0.37 M$
	16%	EDR+MFA	2	63 k$	0.33 M$
Financial	8%	EDR+MFA+Backup	3	85 k$	0.19 M$
	2%	EDR+MFA+Backup+Training	4	97 k$	0.12 M$
Manufacturing	all	EDR+Backup	2	67 k$	0.15 M$

The results in Table 4 show substantial risk reduction across all three profiles under both optimisation modes 1 and 3. Under Mode 1 (two controls), CVaR reductions of 72%, 63%, and 81% are achieved for healthcare, financial, and manufacturing respectively, at portfolio costs of 67, 63, and 67 k$. Mode 3 (cost-efficiency greedy) yields 82%, 67%, and 81% CVaR reductions at costs of 97, 52, and 67 k$. The healthcare sector, characterised by the highest breach costs [23] and frequency [48], achieves a Mode 1 ROI of 51.7 (each k$ invested saves 51.7 k$ in expected annual losses) with a payback period under one week. For financial services, Mode 3 strictly dominates Mode 1: the Training + MFA + Backup portfolio (52 k$, ROI = 26.2) outperforms MFA + EDR (63 k$, ROI = 21.4) in both cost and return, demonstrating that Security Awareness Training (12 k$, $r_{i,f}^F=0.27$) is the most cost-efficient first control for the financial sector.

7.3. Gordon–Loeb Consistency Check

Table 6 confirms that every portfolio selected under Modes 1 and 3 lies strictly within the Gordon–Loeb rational investment region for all three sectors. Mode 1 costs range from 4.9% (Healthcare) to 18.1% (Manufacturing) of the respective GL bounds; Mode 3 from 7.0% (Healthcare) to 18.1% (Manufacturing). Both ranges are consistent with the empirical finding of Gordon et al. [19] that observed security spending typically falls between 5% and 20% of the GL bound.

Table 6. CPT portfolio costs versus the Gordon–Loeb upper bound (Class I vulnerability function) [18]. $p_0=1-e^{-{\widehat{\lambda }}_0}$; GL bound $=\mathbb{E}\left[L\right]·p_0/e$. Mode 1: best portfolio with at most 2 controls (Section 6.1, eq. 39). Mode 3: cost-efficiency greedy portfolio (eq. 42). All portfolio costs lie strictly below the GL bound.

Sector	$\mathbb{E}\left[\mathit{L}\right]$	$p_0$	GL	Mode 1		Mode 3
	(M$)		(k$)	Cost (k$)	%GL	Cost (k$)	%GL
Healthcare	14.05	0.267	1,378	67	4.9%	97	7.0%
Financial Svc	8.83	0.173	562	63	11.2%	52	9.3%
Manufacturing	7.71	0.131	371	67	18.1%	67	18.1%

Table 6. CPT portfolio costs versus the Gordon–Loeb upper bound (Class I vulnerability function) [18]. $p_0=1-e^{-{\widehat{\lambda }}_0}$; GL bound $=\mathbb{E}\left[L\right]·p_0/e$. Mode 1: best portfolio with at most 2 controls (Section 6.1, eq. 39). Mode 3: cost-efficiency greedy portfolio (eq. 42). All portfolio costs lie strictly below the GL bound.

Sector	$\mathbb{E}\left[\mathit{L}\right]$	$p_0$	GL	Mode 1		Mode 3
	(M$)		(k$)	Cost (k$)	%GL	Cost (k$)	%GL
Healthcare	14.05	0.267	1,378	67	4.9%	97	7.0%
Financial Svc	8.83	0.173	562	63	11.2%	52	9.3%
Manufacturing	7.71	0.131	371	67	18.1%	67	18.1%

Two additional observations follow from Table 6. First, the sector-specific budgets $B_s$ chosen in Section 6.1 are themselves well below the GL bound ($B_{\mathrm{HC}}/\mathrm{GL}=7.3\%$, $B_{\mathrm{Fin}}/\mathrm{GL}=17.8\%$, $B_{\mathrm{Man}}/\mathrm{GL}=20.2\%$), confirming that the budget constraints are economically rational rather than artificially restrictive. Second, for Financial services, the Mode 3 portfolio (52 k$, 9.3% of GL) dominates Mode 1 (63 k$, 11.2% of GL) in both absolute cost and return on investment (ROI 26.2 vs. 21.4), illustrating that the GL bound is a necessary but not sufficient condition for optimality: cost-efficiency ordering of controls matters beyond budget feasibility.

7.4. Sensitivity Analysis

A one-at-a-time (OAT) sensitivity analysis [44] is conducted by varying each parameter by $\pm 25\%$ from its calibrated central value and recording the resulting percentage change in CVaR_0.95 for the healthcare baseline. The results (Table 7) identify $l_{max}$ as the most influential parameter (a 25% increase in $l_{max}$ increases CVaR by 20.9%), followed by ${\lambda }_0$ and the confidence level $\alpha$. The mode $l_{\mathrm{mode}}$ has moderate influence, while the lower bound $l_{min}$ has negligible effect on CVaR, as it governs only the near-zero tail of the distribution. These sensitivities are computed relative to the calibrated simulation baseline CVaR_0.95 $=30.9$ M$.

7.5. Distribution Robustness

To assess the robustness of the triangular severity assumption, we recompute CVaR_0.95 for the healthcare baseline (${\widehat{\lambda }}_0=0.31$, $\mathbb{E}\left[L\right]=14.05$ M$, $N=200,000$, seed = 42) under two alternative severity distributions, keeping ${\lambda }_0$ and $\mathbb{E}\left[L\right]$ unchanged:

(i).

Lognormal$\mathrm{LN}(\mu ,\sigma )$ with $\sigma =0.648$, the empirical MLE estimate from cyber breach loss data [13,43], and $\mu =ln\mathbb{E}\left[L\right]-{\sigma }^2/2=2.433$, derived analytically to preserve $\mathbb{E}\left[L\right]=14.05$ M$. The CVaR uplift of $+18.6\%$ is an observed consequence.

(ii).

Generalized Pareto Distribution (GPD) [39] with shape $\xi =0.20$, threshold $u=l_{min}=0.38$ M$, and scale $\sigma =0.683·\mathbb{E}\left[L\right]=9.60$ M$. Unlike a classical Peaks-over-Threshold model [10] – which fits GPD only to exceedances above a high quantile – this parameterises the full severity distribution from $l_{min}$, with $\sigma$ chosen so that tail weight is comparable to the Lognormal. The shape $\xi =0.20$ implies a Pareto index ${\alpha }_P=1/\xi =5.0$, consistent with empirical estimates for cyber loss extremes [13]. The CVaR uplift of $+33.9\%$ is likewise observed.

The uplifts arise from a structural difference: the Triangular distribution has compact support $[l_{min},l_{max}]$, bounding every loss at $l_{max}=32$ M$ by construction. The Lognormal and GPD have unbounded right tails; CVaR_0.95 captures precisely this excess tail mass, so it is systematically higher under both alternatives. The Lognormal uplift ($+18.6\%$) is moderate because its tail decays faster than Pareto; the GPD ($+33.9\%$) is heavier, consistent with heavy-tail evidence from Maillart and Sornette [28] and Romanosky [43].

These results confirm that the triangular-baseline risk metrics in Table 4 are conservative: under heavier-tailed severity assumptions preserving the same $\mathbb{E}\left[L\right]$, identical portfolio optimisation modes (Section 6.1) would yield even higher ROI figures. Apparently, the Lognormal or Generalized Pareto (or maybe other thick-tail distributions) look promising for playing the default severity model in future deployments - but only apparently - see the discussion in Section 8.2.

8. Discussion

8.1. Practical Implications

Cost-effective risk reduction across all sectors: Portfolio costs ranging from 52 k$ (Mode 3 Financial) to 97 k$ (Mode 3 Healthcare) per year achieve CVaR_0.95 reductions of 63–82% across all three organisational profiles (Table 4), placing every selected portfolio within 5–18% of the respective Gordon–Loeb rational investment bound (Table 6). These budgets are feasible for medium-scale organisations (250–2,000 employees) in all three sectors, confirming the economic case for proactive cyber-risk quantification even under conservative modelling assumptions.

Mode 1 versus Mode 3: a sector-dependent choice: Mode 1 (best maximum-two-control portfolio) achieves ROIs of 51.7× (Healthcare, 67 k$), 21.4× (Financial, 63 k$), and 13.9× (Manufacturing, 67 k$) with sub-month payback periods, providing CFO-level financial justification that qualitative risk assessments cannot deliver. Mode 3 (cost-efficiency greedy) offers a richer picture: for Healthcare it selects four controls (MFA + Backup + Training + EDR, 97 k$) achieving 82% CVaR reduction; for Financial it strictly dominates Mode 1 – Training + MFA + Backup at 52 k$ yields ROI = 26.2 versus ROI = 21.4 for MFA + EDR at 63 k$, demonstrating that Security Awareness Training (12 k$, $r_{i,f}^F=0.27$) is the most cost-efficient first control in the financial sector and should be deployed before EDR. For Manufacturing, Modes 1 and 3 converge to the same two-control portfolio (EDR + Backup, 67 k$, 86% CVaR reduction), confirming that supply-chain-dominated threat profiles exhaust the marginal return of additional controls quickly.

Mode 2 as a sequential deployment roadmap: The Mode 2 efficient frontier (Table 5) translates directly into an implementation timeline:

-at threshold $\tau =16\%$ a two-control portfolio is optimal for all sectors (and that would regularly mean from 2 to 4 weeks to deploy);

-at $\tau =8\%$ a third control is justified for Healthcare and Financial;

-at $\tau =2\%$ a fourth control is added.

Manufacturing reaches diminishing returns at $k=2$ regardless of $\tau$, indicating that investment beyond EDR + Backup should be directed to supply-chain governance measures outside the five controls modelled here.

Severity dominates frequency in CVaR: The OAT sensitivity analysis (Table 7) shows that $l_{max}$ – the upper bound of the severity distribution – is the dominant driver of CVaR_0.95 ($+20.9\%$ per $+25\%$ perturbation), significantly ahead of ${\lambda }_0$ ($+12.3\%$). This implies that controls which reduce the magnitude of losses (severity-reducing: Offsite Backup with $r_{i,s}\ge 0.42$ across all sectors; EDR with dual effect $r_{i,f}\ge 0.36$ and $r_{i,s}\ge 0.32$) produce larger CVaR reductions than controls targeting only frequency. The Mode 1 result – EDR + Backup optimal for Healthcare and Manufacturing, MFA + EDR for Financial – is consistent with this finding: EDR and Backup together address the dominant tail-severity component while EDR also provides substantial frequency reduction.

Heavy-tail adjustment: The robustness analysis (Table 8) shows that under Lognormal or GPD severity, CVaR is from 19% to 34% higher than the triangular baseline – while $\mathbb{E}\left[L\right]$ is preserved. The practical implication is that the ROI figures in Table 4 are lower bounds: organisations whose loss distribution has heavier tails than the calibrated triangular would realise proportionally larger benefits from the same security investment.

8.2. Apparent Limitations vs. Robustness of Portfolio Choices

Each modelling assumption below is stated as a formal apparent limitation, then immediately countered by logical evidence or by facts from the numerical results (Table 4, Table 5 and Table 6) showing that the portfolio selections are robust with respect to the corresponding imperfection / objection / limitation. Directions for future works are then sketched around the current modelling assumption.

Non-stationarity of ${\lambda }_0$

Apparent limitation: The Poisson process (1) assumes a constant incident rate ${\lambda }_0$, violated by adaptive adversary behaviour, zero-day campaigns, and seasonal patterns documented in ENISA Threat Landscape [15].

Counter-argument: The OAT sensitivity analysis (Table 7) shows that a $\pm 25\%$ change in ${\lambda }_0$ shifts CVaR_0.95 by only $\pm 12.3\%$ – less than half the impact of the dominant parameter $l_{max}$ ($\pm 20.9\%$). The optimal controls under Modes 1 and 3 (EDR, Backup) target severity reduction, whose value is independent of whether ${\lambda }_0$ is constant or time-varying: even if the true incident rate doubles, a backup that neutralises ransomware damage reduces CVaR by the same relative amount. Non-stationarity therefore inevitably weakens the precision of EL estimates but does not alter the ranking of controls or the portfolio composition.

Possible Future works: An inhomogeneous Poisson process with time-varying $\lambda \left(t\right)$ estimated via Hawkes self-exciting processes [20] from SOC (Security Operations Center) telemetry would very probably tighten confidence intervals, but without changing control selection, especially in the case of a greedy selection - which is the most often the case in practice.

Independence of attack types

Apparent limitation: The CPT model treats incidents as independent events: a supply-chain compromise that simultaneously triggers ransomware and data exfiltration is counted as two events with independent losses.

Counter-argument: Positive correlation between co-occurring attacks makes the greedy selection of a single security control only more valuable, not less. If – for example – one supply-chain event causes both ransomware and exfiltration, then EDR (Endpoint Detection and Response - which stops malware execution) and Backup (which neutralises ransomware impact) jointly address both manifestations of the same correlated event. The independence assumption is therefore proven conservative: it underestimates the benefit of controls that address multiple correlated threat paths simultaneously. Specifically, for Manufacturing, where supply-chain events are the dominant vector (Table 1), the EDR + Backup portfolio addresses the compound event only more effectively than the independent model accounts for – so the ROI of 13.9× in Table 4 is just a lower bound.

Possible future works: Gaussian or Clayton copula models [14] would quantify the positive dependence between co-occurring attack types and likely increase estimated portfolio ROI.

Under-reporting bias

Apparent limitation: DBIR and IC3 datasets record reported incidents only, while different studies suggest 60–80% of cyber incidents go unreported [1,9], implying that the calibrated ${\lambda }_0$ values in Table 1 underestimate the true incident rate.

Counter-argument: If the true ${\widehat{\lambda }}_0$ is $\kappa$-fold higher (with $\kappa >1$), then ${\mathrm{EL}}_{\mathrm{base}}$ scales by $\kappa$ and so does the numerator of every ROI in Table 4, while portfolio costs $c_i$ stay unchanged. The ROI ratios therefore can only increase proportionally with under-reporting severity: at $\kappa =2$ (half of incidents unreported), the Mode 1 Healthcare ROI rises from 51.7× to ≈103×. Hence, under-reporting strengthens, rather than undermines, the investment case. Furthermore, the relative ranking of controls – which defines portfolio composition – is invariant to a uniform scaling of ${\lambda }_0$, so the optimal portfolios in Table 4 remain valid regardless of the reporting rate!

Possible future works: A formal Bayesian debiasing approach using regulatory mandatory reporting rates would sharpen EL estimates - but without altering the greedy portfolio selection methodologies.

Compact support of the Triangular distribution

Apparent limitation: The Triangular distribution bounds every loss at $l_{max}$, excluding catastrophic tail losses to which Lognormal and GPD (Generalised Pareto) models assign positive probability; Table 8 shows CVaR uplifts of $+18.6\%$ and $+33.9\%$ under these alternatives.

Counter-argument: The sensitivity analysis (Table 7) confirms that $l_{max}$ is the dominant CVaR driver ($+20.9\%$ per $+25\%$ perturbation). Controls with high severity-reduction factors (Backup: $r_{i,s}\ge 0.42$; EDR: $r_{i,s}\ge 0.32$) address the tail directly – and their relative advantage can only increase under heavier-tailed distributions because the tail mass they eliminate is larger! The Mode 1 portfolio (EDR + Backup for Healthcare and Manufacturing; MFA + EDR for Financial) would remain optimal or near-optimal even under Lognormal or GPD severity because severity-reducing controls become more (not less) valuable as the tail grows!

Possible future works: Lognormal severity with $\sigma$ estimated from organisational loss records can be further tested, while GPD should be used for deepening the study of tail-risk stress scenarios.

Single-period evaluation horizon.

Apparent limitation: The framework evaluates one-year ROI, ignoring multi-period NPV (Net Present Value), security investment depreciation, and the evolution of the threat landscape.

Counter-argument: Payback periods of 0.2–0.9 months (Table 4) are so short that any reasonable multi-period discount rate leaves the investment recommendation unchanged! Even at a 50% annual depreciation rate on security controls, the discounted multi-year benefit of a greedy-selected portfolio with sub-month payback far exceeds its cost over any two-year horizon! The single-period limitation affects the precision of long-term financial projections but not the sign of the investment decision!

Possible future works: A multi-period NPV model incorporating threat landscape evolution (e.g., the 18% annual increase in manufacturing breach costs observed between IBM CODB 2023 and 2024) and control effectiveness decay would eventually strengthen the financial decision basis for multi-year budget cycles - but not for short term cybersecurity budget forecasting.

Real-time streamed AI-augmented calibration

Apparent limitation: The adaptive cyber-risk digital twin paradigm – where simulation parameters are continuously updated from real-time threat intelligence feeds – represents probably the next frontier for operational deployment of MC-based cyber risk frameworks; the underlying need for continuously-updated, self-exciting attack-rate models is itself supported by the point-process literature [38,50].

Counter-argument: The modular architecture ($\mathtt{ccptmcs\_framework.py}$) of the present framework is designed to accommodate parameter updates (coming from any direction) without structural changes to the CPT model, portfolio optimiser, or risk metric computation.

Possible future works:

Real-time threat intelligence ingestion: Integrate application programming interfaces (APIs) from commercial threat intelligence platforms (e.g., Recorded Future, CrowdStrike Falcon, VirusTotal) and open-source feeds (e.g., AlienVault OTX, MISP) to automatically update ${\lambda }_0$, $r_{i,f}$, and $r_{i,s}$ parameters as new indicators of compromise (IoCs), exploit disclosures, or attack pattern shifts emerge. This would transform the framework from a static calibration tool into a living risk model that reflects the current threat landscape within minutes to hours rather than months to years.

Bayesian sequential updating: Replace the current point-estimate calibration with a fully Bayesian hierarchical model. Prior distributions for ${\lambda }_0$ and severity parameters would be derived from the seven public databases (Section 5). As new incident data arrive – whether from internal security operations center (SOC) logs, industry information sharing and analysis centers (ISACs), or regulatory breach notifications – the posterior distributions would be updated via Markov Chain Monte Carlo (MCMC) or variational inference [4]. This yields not only updated point estimates but also shrinking confidence intervals that quantify the value of each new observation.

Hawkes process for self-exciting incident dynamics: The current Poisson assumption (1) treats incident arrivals as memoryless. Empirical evidence suggests that cyber incidents exhibit a kind of self-exciting alike behavior: a successful breach increases the probability of follow-on attacks (e.g., ransomware gangs re-infecting the same network, or copycat attacks). A Hawkes process [20], already applied to cyber-attack-rate modelling [38], with intensity $\lambda \left(t\right)=\mu +{\int }_0^t\varphi (t-s)dN\left(s\right)$ would capture this clustering. The modular design of $\mathtt{ccptmcs\_framework.py}$ allows replacing the Poisson generator with a Hawkes simulator without altering the loss aggregation or portfolio optimization layers.

Meta-learning for cross-sector transfer: The current calibration is sector-specific (healthcare, financial, manufacturing). However, many organizations operate in niche sectors with sparse collected incident data. Meta-learning (i.e. "learning to learn") techniques [21] could be applied: pre-train a neural process or Bayesian neural network on the seven public databases across all sectors, then fine-tune on a target organization’s limited internal incident reports using only tens of observations. This would "democratize" access to quantitatively calibrated cybersecurity risk models for small and medium enterprises (SMEs) in under-represented sectors such as non-profits, educational institutions, or critical infrastructure sub-sectors.

Adversarial robustness and red-team simulation: The current framework assumes that security controls’ mitigation factors $r_{i,f}$ and $r_{i,s}$ are static estimates derived from DBIR and MITRE ATT&CK. In reality, sophisticated adversaries might adapt (and eventually correlate) their tactics to bypass deployed controls. Future work could embed a game-theoretic layer: a simulated "red team" that re-optimizes its attack strategy conditional on the defender’s chosen portfolio $\mathbf{x}$. The resulting Nash equilibrium [33] would yield robust mitigation factors that account for strategic adaptation, preventing an eventual over-optimism about control effectiveness that emerges from static calibration.

Federated learning for privacy-preserving calibration: Organizations are justifiably reluctant to share detailed incident data due to legal liability and reputational risks. A federated learning architecture [31] would allow multiple organizations to collaboratively train a shared global model of incident frequency and severity without exchanging raw data! Each organization would compute local parameter updates from its own incident logs, and only encrypted gradients or model weights (but not the underlying data) would be aggregated by a central "coordinator". This would vastly expand the empirical basis for calibration beyond the seven public databases, which represent only a fraction of all incidents due to under-reporting bias (see Section 8).

Explainable AI (XAI) for auditability: Regulators and board-level decision-makers increasingly demand not just risk figures but auditable justifications. Future work might integrate post-hoc explanation methods (SHapley Additive exPlanations – SHAP [27], Local Interpretable Model-agnostic Explanations – LIME [41], or counterfactual explanations [49]) into the calibration pipeline. For any output metric (e.g., ${\widehat{\mathrm{CVaR}}}_{0.95}=8.7$ M$ for the Healthcare Mode 1 portfolio), the system would produce a human-readable report attributing the value to specific input parameters, databases, and assumptions. This would transform the framework from a "black-box simulator" into a more transparent decision-support tool that satisfies internal audit, regulatory (e.g., Digital Operational Resilience Act – DORA [11], NIS2), and legal requirements.

Calibration against cybersecurity insurance claims data: A collaboration with one or more cyber insurance carriers would provide access to validated, real-world claims datasets. Unlike publicly reported incidents (which suffer from selection and under-reporting biases), claims data represent actual financial transfers and include closed claims with full loss accounting. Calibrating the severity distribution against claims data – especially the tail beyond the 95th percentile – would validate or refute the Lognormal and GPD uplifts observed in Table 8 and potentially establish a new empirical benchmark for heavy-tailed cyber loss modelling.

Continuous Integration/Continuous Deployment (CI/CD) for risk models: Future work could plausibly integrate the calibration pipeline into a DevOps-style workflow [45]. Upon each release of the Verizon DBIR, IBM CODB, or ENISA Threat Landscape reports, an automated trigger would: (i) scrape the updated data, (ii) re-run the calibration protocol (Section 5), (iii) recompute all risk metrics and portfolio optimizations (Section 7), (iv) generate an updated technical report, and (v) optionally push revised parameters to deployed instances of $\mathtt{ccptmcs\_framework.py}$ in client organizations. This would ensure that cyber risk assessments never rely on stale data – a critical requirement given the observed 10–18% annual inflation in breach costs.

Counterfactual scenario analysis for stress testing: Future efforts could extend the framework beyond historical calibration to support forward-looking "what-if" scenarios. A scenario engine would allow risk managers to specify hypothetical changes: "What if ransomware severity increases by 50% due to regulatory changes prohibiting ransom payments?" or "What if a zero-day vulnerability in a widely used enterprise software affects 60% of our infrastructure?" The engine would then perturb the relevant parameters ($l_{max}$, ${\lambda }_0$ for specific attack vectors), re-run the Monte Carlo simulation, and quantify the impact on CVaR, optimal portfolio selection, and required budget. This would align the framework with regulatory stress testing requirements (e.g., DORA’s [11] severe but plausible scenarios) and provide strategic early warning for emerging threats (even) before they appear in historical databases!

These future directions share a common theme: transitioning the CPT Monte Carlo framework from a retrospective, static, database-dependent tool to a prospective, adaptive, learning-enabled system that mirrors the dynamics of the threat landscape it seeks to model in an explainable auditable manner. The modular architecture of $\mathtt{ccptmcs\_framework.py}$ is not merely a technical implementation detail – it is the foundation upon which this transition can be built incrementally, without requiring a complete redesign at each evolutionary step.

9. Conclusion

This paper presented a formally specified, empirically calibrated Monte Carlo framework for quantitative cybersecurity risk assessment and security portfolio optimisation. The Compound Poisson–Triangular (CPT) model couples a Poisson incident process with a triangular per-incident severity distribution, both calibrated from seven publicly available databases (DBIR 2024, IBM CODB 2024, IC3 2023, Ponemon 2024, CIS Controls v8, NIST SP 800-30, MITRE ATT&CK), and derives the expected annual loss ${\mathrm{EL}}_{\mathrm{base}}^{\left(s\right)}={\lambda }_0^{\left(s\right)}·\mathbb{E}\left[L^{\left(s\right)}\right]$ analytically from those calibrations rather than treating it as a free parameter.

The key contributions are:

(i) Asector-specific mitigation model (Table 3) in which frequency-reduction $r_{i,f}^{\left(s\right)}$ and severity-reduction $r_{i,s}^{\left(s\right)}$ factors for each control are derived from DBIR 2024 attack-technique frequencies and MITRE ATT&CK mitigation-effectiveness mappings, replacing the uniform per-control values used in prior work. This reveals qualitative differences hidden by uniform calibration: MFA reduces incident frequency by 38–42% in Healthcare and Financial but only 19% in Manufacturing (supply-chain attacks bypass credential-based defences), while Network Segmentation is 26% effective in Manufacturing (OT/IT boundary) but only 11% in Financial - PCI-DSS (Payment Card Industry Data Security Standard) already enforces baseline segmentation.

(ii) A three-mode portfolio optimisation framework (Section 6.1) evaluated under sector-specific budgets ($B_{\mathrm{HC}}=B_{\mathrm{Fin}}=100$ k$, $B_{\mathrm{Man}}=75$ k$, all within 5–20% of the Gordon–Loeb rational investment bound): Mode 1 maximises absolute CVaR reduction with $\le 2$ controls; Mode 2 traces an efficient frontier via greedy marginal thresholds $\tau \in \{16\%,8\%,4\%,2\%,1\%\}$; Mode 3 greedily maximises cost-efficiency $\Delta \mathrm{EL}/c_i$ stopping at the diminishing-returns knee.

(iii) A formal analysis of CVaR coherence and MC estimator confidence intervals (Section 4), establishing that VaR violates sub-additivity (eq. 27) while CVaR satisfies all four Artzner coherence axioms, and deriving a closed-form CI for ${\mathrm{VaR}}_{\alpha }$ based on order-statistic theory.

(iv) An economic consistency validation against the Gordon–Loeb model (Table 6): all Mode 1 and Mode 3 portfolio costs fall within 5–18% of the respective GL bounds, consistent with empirical observations that rational security spending ranges from 5–20% of the GL bound [19].

(v) A distribution robustness analysis (Table 8) showing that CVaR uplifts of $+18.6\%$ (Lognormal) and $+33.9\%$ (GPD) under heavier-tailed severity imply that the triangular baseline results are conservative lower bounds on portfolio ROI.

The numerical experiments (Table 4 and Table 5) yield three findings that are non-obvious from prior qualitative frameworks. First, two well-chosen sector-specific controls achieve 63–82% CVaR_0.95 reduction at portfolio costs of 63–97 k$/year – an ROI range of 13.9× to 51.7× with payback periods of 0.2–0.9 months. Second, for Financial services, Mode 3 strictly dominates Mode 1: Security Awareness Training (12 k$, $r_{i,f}^F=0.27$) is the most cost-efficient first control, yielding a Training + MFA + Backup portfolio (52 k$, ROI = 26.2) that outperforms MFA + EDR (63 k$, ROI = 21.4) in both cost and return – a result invisible to uniform-mitigation models that assign the same effectiveness to Training across all sectors. Third, for Manufacturing, Modes 1, 2, and 3 all converge to the same two-control portfolio (EDR + Backup), confirming that supply-chain threat profiles exhaust the marginal return of additional controls quickly and that further investment should be directed to supply-chain governance outside the five modelled controls.

The framework (ccptmcs_framework.py) is open, reproducible, and architecturally modular, designed to accommodate parameter updates – including AI-augmented calibration from real-time threat intelligence feeds – without structural changes to the CPT model, portfolio optimiser, or risk metric computation. The demonstrated ability to transform public cyber incident statistics into sector-specific, financially interpretable, and auditable risk evidence represents a step toward closing the gap between the quantitative rigour of financial risk management and the predominantly qualitative practice of cybersecurity governance.