Cybersecurity capabilities and cyber-attacks as drivers of investment in cybersecurity systems: A UK survey for 2018 and 2019

Our study explores how cyber-capabilities and cyber-attacks drive investment in cybersecurity systems. We assume that cybersecurity investment is a strategic decision in the organizations. To analyze this research question, we make use of the Cyber Security Breaches Survey data, with a sample consisting of 4,163 UK organizations in the periods 2018 to 2019, and employ machine learning techniques (ANN and K-mean cluster). The study extends the current literature on cybersecurity systems and improves our understanding of it in several ways. First, it provides evidence for how the cybersecurity systems are developed in organizations. Second, regarding what factors affect investment in cybersecurity systems, it shows that organizations invest in cybersecurity based on their cybersecurity capabilities and the ex-perienced cyber-attacks. Third, from a managerial point of view, the paper contributes to understanding cybersecurity within the management of the organization.(c) 2022 The Author(s). Published by Elsevier Ltd. This is an open access article under the CC BY-NC-ND license ( http://creativecommons.org/licenses/by-nc-nd/4.0/ )

Automated summary

Our study examines the impact of cyber-capabilities and cyber-attacks on investment in cybersecurity systems in organizations. The findings show that organizations invest in cybersecurity systems based on their cybersecurity capabilities and experience of cyber-attacks. This study contributes to our understanding of cybersecurity and provides valuable insights for management.