Chapter 4. Methods to assess the economic value of cybersecurity

This chapter of the Quaderno IRCrES on Cybersecurity and data protection in the electricity sector: state-of-the-art of the literature and evaluation methods focuses on demonstrating the suitability of the Cost-Benefit Analysis (CBA) approach for assessing the value of cybersecurity in electrical infrastructures, from the perspective of citizens. Given the absence of market data for such non-market goods, we argue for the validity of Stated Preferences methods, particularly discrete choice experiments. We review the existing literature applying CBA methods to cybersecurity before narrowing our focus to works evaluating the economic valuation of electricity service continuity. This body of work is largely composed of case studies focused on specific countries or environments and discusses the relative merits of willingness to pay versus willingness to accept. Despite a growing interest in the economic implications of service interruptions, our review reveals a consequential gap: the absence of studies examining power outages caused by cyberattacks on critical electricity infrastructures. This highlights an urgent need for further research at the intersection of cybersecurity and energy system resilience.