Article in ssrn electronic Journal · July 015 doi: 10. 2139/ssrn. 2634590 citations 32 reads 1,108 author: Some of the authors of this publication are also working on these related projects

THE COST OF SUCCESSFUL CYBER 
ATTACKS
This section compares the absolute numbers to do with 
the various costs of data breaches with the same numbers 
normalized around the size of the Internet’s contribution 
to the global economy. Underlying this move is the idea 
that we need to understand the cost of cybercrime relative 
to the economic benefits that accrue from the Internet. The 
real concern would be when the costs of doing business are 
greater than the benefits produced by using the Internet 
as a platform for communications and commerce, as 
firms would then opt out of the system. Normalizing the 
numbers in this way shifts the question from what a firm 
pays as a result of data breaches to what sort of economic 
damage is done in general terms by cybercrime compared 
to the benefits that are generated by the Internet economy. 
Again, the absolute numbers consistently suggest a worse 
cyberspace environment than the normalized numbers.
When it comes to the costs of cybercrime, the value added 
of the Internet is outpacing the costs that Internet-enabled 
cybercrime imposes on society. In other words, in net 
terms, having the Internet is still beneficial, even though 
cybercrime inflicts economic damage. In the daily world, 
another example of a sort of dual-use system that both 
generates economic growth and facilitates crime is the 
global financial system, which can be used to provide loans 
and transfer funds, but which can also be used to launder 
money and avoid taxes. At a social level, what matters are 
net gains, and, in the case of the Internet and cybercrime 
— as in the case of the global financial system — things are 
looking pretty good.
Figure 10: Average Cost per Breach
0 
50 
100 
150 
200 
250 
0 
0.02 
0.04 
0.06 
0.08 
0.1 
0.12 
0.14 
0.16 
2008 
2009 
2010 
2011 
2012 
2013