  Cyber-security breaches inflict significant costs on organizations. Hence,
the development of an information-systems defense capability through
cyber-security investment is a prerequisite. The question of how to determine
the optimal amount to invest in cyber-security has been widely investigated in
the literature. In this respect, the Gordon-Loeb model and its extensions
received wide-scale acceptance. However, such models predominantly rely on
restrictive assumptions that are not adapted for analyzing dynamic aspects of
cyber-security investment. Yet, understanding such dynamic aspects is a key
feature for studying cyber-security investment in the context of a fast-paced
and continuously evolving technological landscape. We propose an extension of
the Gordon-Loeb model by considering multi-period and relaxing the assumption
of a continuous security-breach probability function. Such theoretical
adaptations enable to capture dynamic aspects of cyber-security investment such
as the advent of a disruptive technology and its investment consequences. Such
a proposed extension of the Gordon-Loeb model gives room for a hypothetical
decrease of the optimal level of cyber-security investment, due to a potential
technological shift. While we believe our framework should be generalizable
across the cyber-security milieu, we illustrate our approach in the context of
critical-infrastructure protection, where security-cost reductions related to
risk events are of paramount importance as potential losses reach unaffordable
proportions. Moreover, despite the fact that some technologies are considered
as disruptive and thus promising for critical-infrastructure protection, their
effects on cyber-security investment have been discussed little.
