Optimal investment strategy for cyber security management of small and medium-sized enterprises based on the heterogeneous perspective

The rapid development of information technology has brought complex and diverse network security problems. Now, more and more small and medium-sized enterprises, who have weak security foundation, begin to try a new security investment model combining risk management services and cyber security insurance. However, either over-investment or under-investment could result in losses of efficiency in cyber security risk management, and even unacceptable insecurity. Therefore, this paper discusses the small and medium-sized enterprises’ local optimal solutions and global optimal solutions to their multi-player games from the perspective of heterogeneity, and tries to optimize their decision-making model in cyber security investment. On one hand, the result shows that there exists optimal solution for the risk-averse enterprises to achieve optimal and stable equilibrium under non-cooperation circumstance. On the other hand, under cooperation circumstance, although the overall utility of the market would increase, each single enterprise has the motivation to break the equilibrium of cooperation because of the prisoner’s dilemma. There exists no stable equilibrium. Further, this paper studies the effects of insurance deductible and cyber security expense on the wealth utilities of uncooperative enterprises when taking the additional premium into consideration. It is proved that a reasonable level of insurance deductible could increase the enterprises’ wealth utilities. © 2023 Systems Engineering Society of China. All rights reserved.