Gordon-Loeb Model Continues to Shape Cybersecurity Investment and Expand Its Influence in the AI Era

More than two decades after its introduction, the Gordon-Loeb Model still shapes how organizations think about cybersecurity investment, technology risk, and, increasingly, the challenges emerging from artificial intelligence.

One example of the model's practical impact comes from Cadents, an enterprise technology-risk firm specializing in infrastructure assessment and IT operations. The company has incorporated the framework into client-facing resources that help organizations quantify technology risk, justify cybersecurity budgets, and evaluate the return on investment of proactive technology spending. The company cites the model, developed by University of Maryland Robert H. Smith School of Business professors Lawrence A. Gordon and Martin Loeb, as a foundation for helping clients make more economically informed decisions about cybersecurity and broader technology investments.

“Understanding the risks of aging or outdated hardware and software has always been a challenge in our field,” says Cadents CEO Julie Case. “The model has strengthened our position on the critical need to establish IT budgets that could save tens or hundreds of thousands of dollars by preventing outages and breaches. Our core mission is to ensure that nothing critical is ever unknown.”

Cadents recently explored the Gordon-Loeb Model’s practical application in a blog post, arguing that technology-risk budgets should be based on financial exposure rather than historical spending. Drawing on the Gordon-Loeb framework, the article asks: “How much should an organization invest to reduce risk—and at what point does additional spending stop making economic sense?” It contends that organizations should assess both “potential financial loss” and “current technology risk exposure” when determining investment levels. The post further argues that effective risk management is not simply a matter of spending more, but of identifying a defensible investment range that balances risk reduction with efficient capital allocation. Through its Technology Risk Budget Validator, Cadents applies these principles to help organizations move budget discussions from guesswork to economically grounded, risk-based decision-making and prioritization.

The framework’s growing relevance extends beyond traditional cybersecurity concerns, Gordon notes, as organizations increasingly seek ways to evaluate and manage the risks associated with emerging AI technologies.

Cadents’ application and testimonial, while highlighting the framework’s value for cybersecurity budgeting, points to a broader, increasingly important insight, says Gordon, EY Alumni Professor of Managerial Accounting and Information Assurance. “The model applies to a wide range of technology-related problems in which technology risk is a key concern, including AI. That argument may well be the primary reason that the paper where the model was originally published is experiencing such accelerated growth in Google Scholar citations.”

Growing Momentum Across Research and Practice

Introduced in 2002 (“The Economics of Information Security Investment”) as the first rigorous economic model to derive the relationship between cyber risk and optimal cybersecurity investment, the framework now attracts renewed attention from researchers beyond the traditional cybersecurity and information systems fields, Gordon says. “Mathematicians have become increasingly interested in cyber risk, particularly in determining the optimal level of cybersecurity investment.”

Such evidence, he adds, appears in “A Stochastic Gordon-Loeb Model for Optimal Cybersecurity Investment under Clustered Attacks,” forthcoming in Annals of Actuarial Science and published by Cambridge University Press. The paper extends the framework to new quantitative settings and reflects its growing influence across actuarial science, mathematics, and risk modeling.

The momentum has also led to an invitation to Gordon to give a two-hour mini tutorial at the Society for Industrial and Applied Mathematics’ Conference on Financial Mathematics and Engineering in Washington, D.C., in June 2027. He will co-present “Cyber Risk: The Evolution of the Gordon-Loeb Model and New Approaches to Optimal Cybersecurity Investment” with faculty colleague Lei Zhou, Smith’s MS in Accounting academic director, and Caroline Hillairet, a professor at ENSAE Paris.

Gordon notes that only two mini tutorials will be featured at the three-day conference, giving his, Zhou's and Hillairet’s session “an especially prominent place in the program and illustrating the model's growing visibility among scholars and practitioners working on quantitative approaches to risk and decision-making.”

New Stage of Impact

The model’s citation trajectory, Gordon says, appears to correlate in part with cybersecurity concerns emerging around AI.

“Organizations and researchers facing new forms of technological risk are increasingly turning to frameworks that balance economic considerations with uncertainty, helping drive fresh interest in the model’s foundational insights,” he says. “The developments in both mathematics and AI-related research suggest that the model is entering a new and particularly important stage in its impact and evolution.”

Dean’s Professor of Information Systems Louiqa Raschid says the Gordon-Loeb Model continues to demonstrate its lasting relevance. “Developed at Smith more than 20 years ago, it remains an influential framework for understanding technology risk, informing practitioner decisions, inspiring new research and helping organizations navigate an increasingly complex digital landscape. As Cadents’ experience demonstrates, its influence extends beyond cybersecurity investment decisions to a broader range of technology-risk management challenges.”