SECAdvisor: A Tool for Cybersecurity Planning using Economic Models

Cybersecurity planning is challenging for digitized companies that want adequate protection without overspending money. Currently, the lack of investments and perverse economic incentives may increase the number of cyberattacks, which result in several economic impacts on companies worldwide. Therefore, cybersecurity planning has to consider technical and economic dimensions to help companies achieve a better cybersecurity strategy. This paper introduces SECAdvisor, a tool to support cybersecurity planning using economic models. SECAdvisor allows one to (a) understand the risks and valuation of different businesses’ information, (b) calculate the optimal investment in cybersecurity for a company, (c) receive a recommendation of protections based on the budget available and demands, and (d) compare protection solutions in terms of cost-efficiency. Furthermore, evaluations on usability and real-world training activities performed using SECAdvisor show its efficacy and usability, allowing users to explore economic concepts and models for cybersecurity planning.