Benefit–cost–risk analysis of cybersecurity R&D

Abstract A frequently asked question about government-funded research and development (R&D) projects is: What is the return on investment (ROI)? We initially addressed this question by conducting a benefit–cost–risk analysis (BCRA) and adapting it to 25 R&D projects funded by the Science and Technology Directorate (S&T) of the United States Department of Homeland Security (DHS). The net benefits and the associated benefit-to-cost ratios were mostly high for transitioned and used projects. Still, substantial uncertainty remained about the benefits of projects in transition that had not yet been implemented or put to use. Conducting BCRAs on cybersecurity R&D poses additional problems. First, many cybersecurity R&D projects are at a low technology readiness level (TRL). Second, the benefits of cybersecurity are the avoided risks and damages, which are very uncertain. Our objective is to provide a proof-of-concept demonstration of a novel BCRA methodology that accounts for uncertainties in the cybersecurity R&D domain. The innovative methodology described in this paper consists of conducting a BCRA, assuming that the cybersecurity R&D proj