Optimal deployment of third-party cybersecurity tools for reducing risk in operational technology environments: A power plant use-case

Operational Technology (OT) cybersecurity in power plants increasingly relies on third-party monitoring and protection tools, whose effectiveness, cost, and operational impact are often difficult to compare. This paper proposes a framework that minimizes expected annual cybersecurity expenditure and cyberattack-induced production loss. Its methodological contribution is the joint formulation of portfolio selection and marginal investment justification, accounting for overlapping protection benefits and diminishing returns as tools are added. The framework identifies both the preferred tool combination under assumed effectiveness levels and the additional risk reduction required to justify each investment. Simulations on a representative power plant examine how portfolio choices depend on baseline attack probability and disruption costs, and identify break-even conditions for sequential implementation. These outputs support plant-specific investment decisions rather than universal deployment recommendations. Open-source code and a graphical user interface enable practitioners to repeat the analysis using their own technical and economic assumptions.