2.1 The Gordon–Loeb model

The Gordon–Loeb model, introduced in 2002 in the seminal work (Gordon & Loeb, Reference Gordon and Loeb2002), provides a static framework for determining the optimal investment in cybersecurity to protect a given information set under the threat of cyberattacks. In our context, the information set corresponds to the entity’s IT infrastructure. In the Gordon–Loeb model, the information set is characterized by three key parameters, all assumed to be constant:

• • $p \,{\in \,[0,\,1]}$ : the probability that a cyberattack occurs;

• • $v \,{\in \,[0,\,1]}$ : the baseline probability that a cyberattack successfully breaches the information set (vulnerability);

• • $\ell \,{\ge \, 0}$ : the loss incurred when a breach occurs.

The vulnerability $v$ refers to a baseline level of security, reflecting the cybersecurity measures already in place before any new decision is taken. Without any further investment in cybersecurity, the expected loss is $vp\ell$ . To mitigate its vulnerability, the entity may invest an additional amount $z \geq 0$ in cybersecurity. The variable $z$ therefore represents incremental cybersecurity investment beyond the existing baseline protection. In particular, $z = 0$ means that no further investment is made, but the system still retains the prior protection embodied in $v$ . Throughout the paper, absence of cybersecurity investment will refer to the case $z = 0$ . The effectiveness of the investment $z$ is measured by a security breach probability function $S(z, v)$ , which represents the probability that an attack successfully breaches the information set, given investment level $z$ and the vulnerability $v$ . The resulting expected loss is thus $S(z, v)p\ell$ . Gordon and Loeb require the function $S$ to satisfy the properties listed in the following assumption.

Gordon and Loeb consider two classes of security breach probability functions, which satisfy AssumptionA:

(2) \begin{equation} S_I(z, v) = \frac {v}{(az+1)^b} \quad \text{and}\quad S_{II}(z, v) = v^{a z+1}, \end{equation}

for some parameters $a, b\gt 0$ .

In Gordon and Loeb (Reference Fedele and Roner2002), the optimal investment in cybersecurity is determined by maximizing the Expected Net Benefit of Investment in Information Security (ENBIS), defined as follows:

(3) \begin{equation} \text{ENBIS}(z) \,:\!=\, (v - S(z, v))p \ell - z. \end{equation}

The ENBIS function quantifies the net trade-off between the benefit (captured by the reduction in the expected loss due to the investment in cybersecurity) and the direct cost of investing. Under AssumptionA, the optimal investment level $z^*$ is determined by the following first-order condition:

\begin{equation*} -S_z(z^*,v)p \ell -1=0. \end{equation*}

Remark 1. For both classes of security breach functions in (2), Gordon and Loeb show that the optimal cybersecurity investment never exceeds $1/e\approx 37\%$ of the expected loss:

\begin{equation*} z^*\lt \frac {v p \ell }{e}. \end{equation*}

2.2 A continuous-time model driven by a Hawkes process

We now introduce a continuous-time model for randomly occurring cyberattacks. As discussed in Section 1.1, we want to capture the empirically relevant feature of clustering of cyberattacks while retaining the key elements of the original Gordon–Loeb model reviewed in Section 2.1.

The arrival of cyberattacks is described by a Hawkes process $N=(N_t)_{t\geq 0}$ , defined on a probability space $(\Omega , \mathcal{F}, \mathbb{P})$ , with $N_t$ representing the number of cyberattacks up to time $t$ , for all $t\geq 0$ . As explained in Section 1.1, the process $N$ is characterized by a self-exciting stochastic intensity $(\lambda _t)_{t\geq 0}$ solving the following stochastic differential equation:

(4) \begin{equation} \mathrm{d} \lambda _t= \xi (\alpha -\lambda _t)\, \mathrm{d} t + \beta \mathrm{d} {N}_t, \quad \lambda _0\gt 0, \end{equation}

whose explicit solution is given by (1). In the next proposition (adapted from Dassios & Zhao, Reference Dassios and Zhao2013), we compute the expectation of some basic quantities, which will be used later.Footnote 4

Proposition 1. Let $(N_t)_{t\geq 0}$ be a Hawkes process with intensity $(\lambda _t)_{t\geq 0}$ given in (4 ), with $\beta \lt \xi$ . Then, for all $t\geq 0$ ,

\begin{align*} \mathbb{E}[\lambda _t]&=\frac {\alpha \xi }{\xi -\beta } + e^{-(\xi -\beta )t}\left ( \lambda _0-\frac {\alpha \xi }{\xi -\beta } \right )\!, \\[3pt] \mathbb{E}[N_t]&=\int _0^t \mathbb{E}[\lambda _s] \mathrm{d} s \\[3pt] &= \frac {\alpha \xi }{\xi -\beta } t - \frac {1}{\xi -\beta } \left (\lambda _0-\frac {\alpha \xi }{\xi -\beta } \right ) \big(e^{-(\xi -\beta )t}-1\big). \end{align*}

We denote by $(\tau _i)_{i\in \mathbb{N}^*}$ the random jump times of the process $N$ , representing the arrival times of cyberattacks. For each $t\geq 0$ , we denote by $\mathcal{F}_t\,:\!=\,\sigma (N_s; \, s\leq t)$ the sigma-field generated by the Hawkes process $N$ up to time $t$ , representing the information generated by the history of the attack timings up to time $t$ . In the following, this is assumed to be the information set available to the decision maker (see also RemarkReference Balzano and Marzi3 below).

In the absence of cybersecurity investment, each attack is assumed to breach the entity’s IT system with fixed probability $v$ (vulnerability). For each $i\in \mathbb{N}^*$ , we introduce a Bernoulli random variable $B^v_i$ of parameter $v$ , where the event $\{ B^v_i = 1 \}$ corresponds to a successful breach caused by the $i$ -th attack. In the event of a breach, the entity incurs a random monetary loss $\eta _i$ , realized at the attack time $\tau _i$ . Otherwise, if $B^v_i = 0$ , the attack is blocked and no loss occurs at time $\tau _i$ .

The families of random variables $(B^v_i)_{i\in \mathbb{N}^*}$ and $(\eta _i)_{i\in \mathbb{N}^*}$ are assumed to satisfy the following standing assumption.

The cumulative loss incurred over a planning horizon $[0,T]$ , in the absence of cybersecurity investment, is given by:

(5) \begin{equation} L_T^0 \,:\!=\, \sum _{i=1}^{N_T} \eta _i B_i^v. \end{equation}

In our dynamic model, the entity can react to the evolving threat environment by investing in cybersecurity in order to mitigate its vulnerability to cyberattacks. Investment occurs continuously throughout the planning horizon $[0,T]$ and is described by a non-negative investment rate process $(z_t)_{t \in [0, T]}$ . For each $t\lt T$ , the quantity $z_t$ represents the increase in the level of cybersecurity over the infinitesimal time interval $[t,t+\mathrm{d} t]$ and is assumed to be chosen based on the information set $\mathcal{F}_{t-}$ available to the decision maker just before time $t$ .

Investment in cybersecurity is subject to rapid technological obsolescence (see, e.g., Hayes & Bodhani, Reference Hayes and Bodhani2013). In line with Krutilla et al. (Reference Krutilla, Alexeev, Jardine and Good2021), we take into account this significant aspect in our model by introducing a depreciation rate $\rho \gt 0$ . The cybersecurity level reached at time $t$ is then defined as follows, for all $t\in [0,T]$ :

(6) \begin{equation} H^z_t=H_0e^{-\rho t}+\int _0^t e^{-\rho (t-s)}z_s \mathrm{d} s, \end{equation}

which equivalently, in differential form, reads as follows:

\begin{equation*} \mathrm{d} H^z_t= \left(z_t-\rho H^z_t\right)\mathrm{d} t, \qquad H^z_0=H_0\geq 0. \end{equation*}

As in Krutilla et al. (Reference Krutilla, Alexeev, Jardine and Good2021), we interpret the cybersecurity level as an aggregated asset, which can be thought of as a combination of technological infrastructures, software, and human expertise.

In our continuous-time framework, we let the breach probability evolve dynamically with the current cybersecurity level. More specifically, suppose that the decision maker adopts an investment policy $z=(z_t)_{t\in [0,T]}$ . At each attack time $\tau _i$ , a breach is assumed to occur with probability

(7) \begin{equation} S(H^z_{\tau _i},v), \end{equation}

where $H^z_{\tau _i}$ is given by (6) evaluated at $t=\tau _i$ and $S$ is a security breach probability function satisfying AssumptionA, as in the original Gordon–Loeb model. Hence, the probability that the $i$ -th attack successfully breaches the IT system depends on the cybersecurity level $H^z_{\tau _i}$ reached at the attack’s time $\tau _i$ . In turn, $H^z_{\tau _i}$ is determined by the investment realized over the time period $[0,\tau _i]$ , taking into account technological obsolescence. If the $i$ -th attack breaches the IT system, then the entity incurs a loss of $\eta _i$ ; otherwise, the attack is blocked and the entity does not suffer any loss at time $\tau _i$ .

Analogously to the case without investment in cybersecurity, we can write as follows the cumulative losses $L^z_T$ incurred on the time interval $[0,T]$ when investing in cybersecurity according to a generic rate $z=(z_t)_{t\in [0,T]}$ :

(8) \begin{equation} L_T^z \,:\!=\, \sum _{i=1}^{N_T} \eta _i B_i^{S(H^z_{\tau _i},v )}, \end{equation}

where $(B_i^{S(H^z_{\tau _i},v )})_{i\in \mathbb{N}^*}$ is a family of random variables taking values in $\{0,1\}$ and satisfying the following assumption.

Assumption C. For any process $(z_t)_{t\in [0,T]}$ , it holds that

\begin{equation*} \mathbb{P}\Bigl (B_i^{S(H^z_{\tau _i},v )}=1 \Big | \mathcal{F}_T\Bigr ) = S(H^z_{\tau _i},v), \qquad \text{ for all } i\in \mathbb{N}^*, \end{equation*}

where $(H^z_t)_{t\in [0,T]}$ is determined by $(z_t)_{t\in [0,T]}$ as in (6 ). Moreover, for each $i\in \mathbb{N}^*$ , the random variables $B_i^{S(H^z_{\tau _i},v )}$ and $\eta _i$ are conditionally independent given $\mathcal{F}_T$ .

For strategic decision making, a key quantity is represented by the expected losses due to cyberattacks over the time interval $[0,T]$ when adopting a suitable cybersecurity policy. This is the content of the following proposition, which will be fundamental for addressing the optimal investment problem in Section 3. We denote by $\bar {\eta }\,:\!=\,\mathbb{E}[\eta _i]$ the expected loss resulting from a successful breach, for all $i\in \mathbb{N}^*$ .

Proposition 2. Under Assumptions B and C, it holds that

\begin{align*} \mathbb{E} \left[L_T^0 \right]&= \bar {\eta }\,v\,\mathbb{E}\left [\int _0^T \lambda _t \mathrm{d} t\right ]\!, \\[5pt] \mathbb{E} \left[L_T^z \right]&= \bar {\eta }\,\mathbb{E}\left [\int _0^T S (H^z_t, v )\lambda _t \mathrm{d} t\right ]\!. \end{align*}

Therefore, the expected net benefit of investment is

(9) \begin{align} \mathbb{E}\left[L_T^0-L_T^z\right]&= \bar {\eta }\,\mathbb{E}\left [\int _0^T \left(v-S(H^z_t, v)\right) \lambda _t \mathrm{d} t \right ]\!. \end{align}

Proof. Let $z=(z_t)_{t\in [0,T]}$ be an arbitrary cybersecurity investment rate process. Applying the tower property of conditional expectation and making use of AssumptionsB and C, we can compute

\begin{align*} \mathbb{E}\left[L^z_T\right] &= \mathbb{E}\left [\sum _{i=1}^{N_T} \eta _i B_i^{S(H^z_{\tau _i},v)}\right ] \\[4pt] &= \mathbb{E}\left [\sum _{i=1}^{N_T}\mathbb{E}\left [ \eta _i B_i^{S(H^z_{\tau _i},v)}\Big |\mathcal{F}_T\right ]\right ] \\[4pt] &= \bar {\eta }\,\mathbb{E}\left [\sum _{i=1}^{N_T}S(H^z_{\tau _i},v)\right ] \\[4pt] &= \bar {\eta }\,\mathbb{E}\left [\int _0^TS(H^z_t,v)\mathrm{d} N_t\right ] \\[4pt] &= \bar {\eta }\,\mathbb{E}\left [\int _0^TS(H^z_t,v)\lambda _t\mathrm{d} t\right ]\!, \end{align*}

where the last step follows by definition of intensity (see, e.g., Brémaud, Reference Brémaud1981, Definition II.D7), together with the continuity of the process $H^z$ , which implies that $H^z_{\tau _i}$ coincides with the left-limit $H^z_{\tau _i-}$ , for all $i\in \mathbb{N}^*$ . The first equation in the statement of the proposition follows as a special case by taking $z\equiv 0$ .

4.1 Specification of the model parameters

We report in Tables 1–3 the standard set of the model parameters. Unless mentioned otherwise, the numerical analysis will be performed using the standard set of parameters.

Table 1.

Specification of the security breach function

Table 2.

Parameters of the stochastic intensity

Table 3.

Parameters of the optimization problem

We employ a security breach probability function $S$ of class I, as defined in (2). The parameters’ values in Table 1 are consistent with those determined in Naldi and Flamini (Reference Naldi and Flamini2017) through a calibration based on synthetic data and also used as benchmark inputs in subsequent works (see, e.g., Skeoch, Reference Skeoch2022; Mazzoccoli & Naldi, Reference Mazzoccoli and Naldi2020). Taking $v,a,b$ as in Table 1, the function $h\mapsto S_I(h,v)$ is plotted in Figure 2.

Figure 2

Security breach function (parameters as in Table 1).

The parameters of the stochastic intensity of the Hawkes process (see Table 2) are chosen to generate on average approximately 60 cyberattacks per year. We believe that this is a reasonable figure, in the absence of reliable estimates of the number of cyberattacks targeting a single entity.Footnote 7

Remark 10. For the standard set of parameters, we have $\lambda _0=\alpha$ , and so the stochastic intensity $\lambda _t$ can be expressed as follows:

(19) \begin{equation} \lambda _t = \lambda _0+ \beta \sum _{i=1}^{N_t} e^{-\xi (t-\tau _i)}. \end{equation}

We consider a one-year planning horizon ( $T=1$ ) and set an average loss of $10\text{k}\ $ for each successful breach, resulting in a total expected annual loss of approximately $390 \text{k}\ $ without cybersecurity investments, which is in the same order of magnitude of Skeoch (Reference Skeoch2022). The depreciation rate is set at $\rho =0.2$ , consistently with the technological depreciation rates considered in Krutilla et al. (Reference Krutilla, Alexeev, Jardine and Good2021). The parameter $\gamma$ is set at a rather low value in order to avoid an excessive penalization of large investment rates. Finally, we choose $U(h)=\sqrt {h}$ , representing a strictly increasing and concave CRRA utility function.

4.2 Numerical solution of the HJB-PIDE

As shown in Section 3, determining the optimal cybersecurity investment requires the solution of the non-linear PIDE (16). Due to the complexity of the problem, one cannot expect to find explicitly an analytical solution, and, hence, numerical methods are required. We opt for the method of lines, as described in Yuan (Reference Yuan1999). This technique consists of discretizing the PIDE in the spatial domain $(\lambda ,h)\in (0,\infty )\times \mathbb{R}_+$ but not in time and then in integrating the semi-discrete problem as a system of ODEs. In our setting, we discretize the $(\lambda ,h)$ dimensions with a central difference and then numerically solve the resulting ODE system. Similarly to the case of PIDEs arising in Lévy models (see, e.g., Cont & Voltchkova, Reference Cont and Voltchkova2005), the unbounded space domain $(0,\infty )\times \mathbb{R}_+$ is localized into a bounded domain $[\lambda _{\text{min}},\lambda _{\text{max}}]\times [h_{\text{min}},h_{\text{max}}]$ . We refer to Algorithm1 for a precise description of the implementation of this method.

In our implementation, the algorithm’s meta-parameters are specified as in Table 4.

Table 4.

Meta-parameters for Algorithm1

The value $h_{\text{min}} = 0$ corresponds to the absence of cybersecurity investment, while $h_{\text{max}} = 50$ represents an upper bound that is rarely achieved in our setup under the standard parameter set. We choose $\lambda _{\text{min}}=\lambda _0$ , which coincides with the lower bound of the stochastic intensity $\lambda _t$ ; see equation (19). We set $\lambda _{\text{max}}=\mathbb{E}[\lambda _T] + 7 \sqrt {\text{Var}(\lambda _T)} \approx 216$ in order to ensure that the truncation of the intensity domain does not have any material impact on our numerical results. The value function $V$ is extrapolated beyond $[\lambda _{\text{min}}, \lambda _{\text{max}}]$ by setting

\begin{equation*} V(t,\lambda ,h) = V(t,\lambda _{\text{max}},h), \quad \text{for all } \lambda \gt \lambda _{\text{max}}, \end{equation*}

analogously to the scheme implemented in Ly Vath et al. (Reference Ly Vath, Scotti and Gaigi2025, Section 5.1). When plotting the function $V$ in Section 5, we shall consider a subinterval of $[\lambda _{\text{min}}, \lambda _{\text{max}}]$ : intensity values close to $\lambda _{\text{max}}$ are rarely achieved and might lead to numerical instabilities.

We have implemented Algorithm1 in Python, using the built-in ODE solver scipy.integrate.solve_ivp. We make use of an implicit Runge–Kutta method of the Radau IIA family of order 5 (see Hairer et al., Reference Hairer, Nørsett and Wanner1993 for further details). The computations were performed on an Intel Xeon E5520 CPU equipped with 32 GB of RAM, requiring approximately 23 hours to compute the value function and the corresponding optimal control. To empirically assess the convergence of Algorithm1, we verified that standard discretization error metrics decrease consistently as the spatial grid in $(\lambda , h)$ is refined.

Algorithm 1

Numerical solution of the PIDE (16)

Algorithm 1 Long description

An equation describing the numerical solution of a partial integro-differential equation for optimal cybersecurity investment. The equation involves discretizing the spatial domain and solving the resulting system of ordinary differential equations. The spatial domain is bounded by lambda min, lambda max, h min, and h max. The equation includes partial derivatives with respect to lambda and h, and it involves the function V of t, lambda, and h. The solution process involves approximating these partial derivatives and solving the resulting system of ordinary differential equations.

4.3 Optimal cybersecurity investment rate

Besides determining the optimal net benefit of cybersecurity investments, we aim at computing the real-time adaptive strategy that best responds to the arrival of cyberattacks. To this end, after solving the PIDE (16) via Algorithm1, we compute numerically the optimal investment rate given in equation (17) along a simulated sequence of cyberattacks. This entails simulating a trajectory of the stochastic intensity $(\lambda _t(\omega ))_{t\in [t_{\text{init}},T]}$ , starting from an initial cybersecurity level $H_{\text{init}}$ at time $t_{\text{init}}$ . Our numerical method for the computation of the optimal investment rate is described in Algorithm2 and will be numerically implemented in Sections 5.4.2 and 5.4.3.

Algorithm 2

Numerical computation of the optimal control

Algorithm 2 Long description

The image displays a list of steps for numerical computation of optimal control. Each step is numbered and described in detail. The steps involve setting initial parameters, discretizing intervals, computing values, simulating trajectories, and iterating through states to determine optimal investment rates.

6.1 The role of prevention in cyber-insurance

Cyber-insurance contracts increasingly go beyond the pure compensation of financial losses and often include prevention requirements and bundled cyber-risk mitigation services. In this sense, cyber-insurance combines risk transfer with risk mitigation services and incentives, promoting best practices in cyber-risk management (see Lopez et al., Reference Lopez, Denuit, Ghossoub, Trufin, Kher, Maillart, Raes, Rapior, Skoubani and Spoorenberg2025, for a recent analysis).

In our model, prevention is represented by a cybersecurity investment policy $z\in \mathcal{Z}$ and has a precise actuarial meaning: it changes the aggregate losses $L_T^z$ over the planning horizon by reducing the breach probability at attack times from the baseline $v$ to $S(H_{\tau _i}^z, v)$ . Note that, by lowering the breach probability at attack times, in our model prevention does not only reduce the expected loss but also reduces loss variability. As a result, any underwriting or pricing rule that depends on the level of risk should, in principle, depend on the prevention policy (or on observable proxies of it, as discussed below). Our framework allows quantifying the effect of optimal prevention, which is an essential input for the insurer in order to determine cybersecurity requirements, incentive schemes, and premium differentiation rules across policyholders (see Section 6.2).

A key practical issue is that prevention is only partially observable, creating asymmetric information and moral hazard. Two implementation channels discussed in the literature are consistent with our framework. First, prevention may be delegated to the insurer or to an IT security provider in partnership with the insurer, which is particularly relevant for small firms or policyholders with limited internal expertise. This scheme makes prevention partly contractible and allows joint pricing of risk transfer together with mitigation services (see Zeller & Scherer, Reference Zeller and Scherer2023). Second, when prevention is handled internally by the entity (as a self-protection measure), insurers may rely on incentive-based contracting. One approach is to condition the premium on minimum protection measures, combined with audits and penalties if requirements are not met (see Hofmann, Reference Hofmann2007; Lelarge & Bolot, Reference Lelarge and Bolot2009). Another approach is to rely on principal–agent incentive schemes, as considered in Brachetta et al. (Reference Brachetta, Callegaro, Ceci and Sgarra2025), Mastrolia and Yan (Reference Mastrolia and Yan2025), linking part of the compensation to measurable reduction in risk or losses. In both cases, the insurer needs quantitative tools to assess the impact of prevention measures, as considered in our study.

6.2 Implications for premium determination

To quantify the impact of prevention on cyber-insurance premia, we apply the standard deviation principle (see, e.g., Schmidli, Reference Schmidli2017), for an arbitrary cybersecurity investment policy $z\in \mathcal{Z}$ :

(28) \begin{equation} \pi \big(L^z_T \big)\,:\!=\, \mathbb{E} \big[L^z_T \big] + \theta \,\sigma \big(L^z_T \big), \end{equation}

where $\mathbb{E}[L_T^z]$ is the pure premium and $\theta \sigma (L_T^z)$ is a loading proportional to the standard deviation $\sigma (L^z_T)$ of $L^z_T$ , with $\theta$ typically in $[0.1,0.5]$ . This principle is stable with respect to the monetary unit and captures the impact of prevention on both the expected loss and the dispersion of losses.

We first compare the expected aggregate loss without additional investment, $\mathbb{E}[L_T^0]$ , with the expected aggregate loss under the optimal prevention policy $z^\ast$ , denoted $\mathbb{E}[L_T^{z^\ast }]$ , corresponding to (28) with $z=z^*$ and $\theta =0$ . We compute $\mathbb{E}[L_T^0]$ by Proposition2, while $\mathbb{E}[L_T^{z^\ast }]$ is estimated by Monte Carlo over $100{,}000$ samples, where $z^\ast$ is computed via Algorithm2 starting from $h=0$ . Under the standard parameter set, we obtain (in k$)

\begin{equation*} \mathbb{E} \big[L_T^0 \big]=394.98 \quad \text{and}\quad \mathbb{E} \big[L_T^{z^\ast } \big]=141.77, \end{equation*}

corresponding to a reduction of approximately $65\%$ in the pure premium under the optimal dynamic prevention strategy.

The variance of the losses $L^z_T$ associated to a given cybersecurity investment policy $z\in \mathcal{Z}$ is given in the following lemma. We denote $\bar {\eta }\,:\!=\,\mathbb{E}[\eta _i]$ and $\sigma ^2_{\eta }\,:\!=\,\mathrm{Var}(\eta _i)$ , for $i\in \mathbb{N}^*$ .

Lemma 1. Suppose that Assumptions B and C hold. Assume furthermore that $\eta _i\in L^2(\mathbb{P})$ , for all $i\in \mathbb{N}^*$ . Then, for every $z\in \mathcal{Z}$ , it holds that

\begin{align*} \mathrm{Var}(L^z_T) = &\ \mathbb{E}\left [\int _0^T\Bigl(\sigma ^2_{\eta }\,S (H^z_t,v )+\bar {\eta }^2S (H^z_t,v )\bigl (1-S (H^z_t,v )\bigr )\Bigr )\lambda _t \mathrm{d} t\right ] \\ & + \bar {\eta }^2\,\mathrm{Var}\left (\int _0^TS (H^z_t,v )\,\mathrm{d} N_t\right )\!. \end{align*}

Proof. Let $L_T^z$ be defined as in (8), where $z = (z_t)_{t \in [0,T]}$ is an admissible cybersecurity investment process. By the law of total variance (see, e.g., Billingsley, Reference Billingsley1986, Problem 34.10), we can compute

(29) \begin{equation} \mathrm{Var} \big(L_T^z \big) = \mathbb{E}\left [\mathrm{Var}\left (\sum _{i=1}^{N_T} \eta _i B_i^{S(H^z_{\tau _i},v )}\Bigg |\mathcal{F}_T\right )\right ] + \mathrm{Var}\left (\mathbb{E}\left [\sum _{i=1}^{N_T} \eta _i B_i^{S(H^z_{\tau _i},v )}\Bigg |\mathcal{F}_T\right ]\right ) \end{equation}

For the first term on the right-hand side in (29), it holds that

\begin{align*} & \mathrm{Var}\left (\sum _{i=1}^{N_T} \eta _i B_i^{S(H^z_{\tau _i},v )}\Bigg |\mathcal{F}_T\right ) = \sum _{i=1}^{N_T} \mathrm{Var}\left (\eta _i B_i^{S(H^z_{\tau _i},v )}\Big |\mathcal{F}_T\right ) \\ & = \sum _{i=1}^{N_T}\Bigl (\sigma ^2_{\eta }\,S (H^z_{\tau _i},v )+\bar {\eta }^2S (H^z_{\tau _i},v )\bigl (1-S (H^z_{\tau _i},v )\bigr )\Bigr ), \end{align*}

while for the second term we have that

\begin{equation*} \mathbb{E}\left [\sum _{i=1}^{N_T} \eta _i B_i^{S(H^z_{\tau _i},v )}\Bigg |\mathcal{F}_T\right ] = \bar {\eta }\sum _{i=1}^{N_T}S (H^z_{\tau _i},v ). \end{equation*}

Therefore, we can write that

\begin{align*} \mathrm{Var}\big(L^z_T \big) &= \sigma ^2_{\eta }\,\mathbb{E}\left [\sum _{i=1}^{N_T}S(H^z_{\tau _i},v )\right ] \\ &\quad + \bar {\eta }^2\,\mathbb{E}\left [\sum _{i=1}^{N_T}S(H^z_{\tau _i},v )\bigl (1-S(H^z_{\tau _i},v )\bigr )\right ] \\ &\quad + \bar {\eta }^2\,\mathrm{Var}\left (\sum _{i=1}^{N_T}S(H^z_{\tau _i},v )\right )\!. \end{align*}

Arguing as in the proof of Proposition2 yields the formula for $\mathrm{Var}(L^z_T)$ in the statement of the lemma.

In the case $z\equiv 0$ (hence $S(0,v)=v$ ), the formula of Lemma1 simplifies to

\begin{equation*} \mathrm{Var} \big(L_T^0\big) = \mathbb{E}[N_T]\big (\sigma ^2_{\eta }v + \bar {\eta }^2 v(1-v)\big ) + \bar {\eta }^2 v^2 \mathrm{Var}(N_T). \end{equation*}

This expression can be made fully explicit by using the closed-form expressions for $\mathbb{E}[N_T]$ and $\mathrm{Var}(N_T)$ available for Hawkes processes (see Hillairet & Réveillac, Reference Hillairet and Réveillac2025, Section 2.1). For the optimal policy $z^\ast$ , the quantities appearing in Lemma1 are computed by Monte Carlo over $100{,}000$ samples.

Table 6 reports the standard deviations of $L_T^0$ and $L_T^{z^\ast }$ for different values of $\sigma ^2_{\eta }$ (with $\bar {\eta }$ fixed), showing a reduction of roughly $53\%$ – $57\%$ under optimal prevention. Table 7 reports the corresponding premia under (28) with $\theta =0.3$ . Across the scenarios considered, the premium under optimal prevention is about $63\%$ lower than in the no-investment benchmark. These results quantify how dynamic optimal cybersecurity investment translates into lower premia.

Table 6.

Standard deviations

Table 7.

Premia (std deviation principle)

The values $\pi (L_T^{z^\ast })$ and $\pi (L_T^0)$ provide natural benchmark lower and upper premia corresponding to optimal prevention and to the absence of additional cybersecurity investment, respectively. More generally, when policyholders are classified into prevention classes using observable proxies (e.g., cybersecurity scores or audits), the model supports premium differentiation across classes: better prevention (corresponding to higher cybersecurity levels) implies lower risk and, therefore, lower actuarial premia under standard premium principles. In this sense, the gap between $\pi (L_T^{0})$ and $\pi (L_T^{z^\ast })$ provides a concrete estimate of the premium range induced by prevention under the standard deviation principle.