• Gordon, Lawrence A., Martin P. Loeb, and William Lucyshyn, “Information Security Expenditures and Real Options: A Wait-and-See Approach,” Computer Security Journal, Vol 19, No. 2, 2003, pp. 1-7.

Empirical evidence suggests that security breaches are an important driver of actual expenditures on information security activities. Although this wait-and-see approach toward information security expenditures may seem unwise on the surface, there is a rational economic explanation for such an approach under the appropriate conditions. Indeed, as shown in this paper, this approach toward information security expenditures may be consistent with the real option (in particular, the deferment option) view of capital budgeting.