Cyber risk has become an increasingly significant challenge for organisations, driven by rapid digitalisation and growing interdependence across industries. As ICT systems expand and underpin critical infrastructure, the attack surface grows, exposing firms to sophisticated and unpredictable threats. The complexity of securing these systems, combined with the uncertainty of future risks and the limitations of historical data, makes it difficult for organisations to determine where and how to invest in cybersecurity. Moreover, in today’s interconnected environment, the consequences of inadequate investment extend beyond individual firms, generating externalities that can impact entire supply chains, critical services, and society as a whole.

While organisations are under pressure to invest in ways that protect their assets and broader networks, traditional approaches to cybersecurity investment have largely focused on normative, technical models that promise rational optimisation. However, these models often overlook the complex realities of organisational life where decisions are shaped not only by economic analysis but also by institutional expectations, internal politics, resource constraints, and the influence of external actors (e.g., consultants, regulators).

Recognising these challenges, my thesis aims to move beyond the search for an “optimal” investment strategy. Instead, it investigates how cybersecurity investment decisions are actually made, negotiated, and justified within real-world socio-technical networks. By tracing how decisions are co-produced through interactions between people, technologies, and institutions, I aim to develop a more dynamic and situated understanding of cybersecurity investment. Therefore, my thesis seeks to challenge assumptions of neutrality, reveal the social and organisational complexities that influence investment strategies, and encourage a more adaptive, context-sensitive approach to securing resilient digital systems.

 

Supervisors: 

Professor Adam Joinson (Bath)

Dr Ola Michalec (Bristol)

Dr Debbie Desrochers (Bath)