{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,24]],"date-time":"2026-03-24T15:03:39Z","timestamp":1774364619055,"version":"3.50.1"},"reference-count":76,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T00:00:00Z","timestamp":1772064000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100014013","name":"UK Research and Innovation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100014013","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000269","name":"UK Research and Innovation Economic and Social Research Council","doi-asserted-by":"publisher","award":["ES W\/005964\/1"],"award-info":[{"award-number":["ES W\/005964\/1"]}],"id":[{"id":"10.13039\/501100000269","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000269","name":"UK Research and Innovation Economic and Social Research Council","doi-asserted-by":"publisher","award":["ES W\/005964\/2"],"award-info":[{"award-number":["ES W\/005964\/2"]}],"id":[{"id":"10.13039\/501100000269","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1016\/j.cose.2026.104873","type":"journal-article","created":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T17:07:10Z","timestamp":1772125630000},"page":"104873","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["A cyber risk economics model for organization-wide risk management (CYREM-ORM)"],"prefix":"10.1016","volume":"165","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9016-9680","authenticated-orcid":false,"given":"Tong","family":"Xin","sequence":"first","affiliation":[]},{"given":"Ying","family":"He","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3110-7495","authenticated-orcid":false,"given":"Efpraxia D.","family":"Zamani","sequence":"additional","affiliation":[]},{"given":"Mark","family":"Evans","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3946-1093","authenticated-orcid":false,"given":"Cunjin","family":"Luo","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.cose.2026.104873_bib0002","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2020.102122","article-title":"How can organizations develop situation awareness for incident response: a case study of management practice","volume":"101","author":"Ahmad","year":"2021","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.104873_bib0003","doi-asserted-by":"crossref","first-page":"1206","DOI":"10.1016\/j.procs.2019.11.234","article-title":"Risk assessment using NIST SP 800-30 revision 1 and ISO 27005 combination technique in profit-based organization: case study of ZZZ information system application in ABC agency","volume":"161","author":"Al Fikri","year":"2019","journal-title":"Procedia Comput. Sci."},{"key":"10.1016\/j.cose.2026.104873_bib0004","series-title":"Managing Information Security Risks: the OCTAVE Approach","author":"Alberts","year":"2003"},{"issue":"1","key":"10.1016\/j.cose.2026.104873_bib0005","doi-asserted-by":"crossref","DOI":"10.25300\/MISQ\/2023\/17316","article-title":"Creating proactive cyber threat intelligence with hacker exploit labels: a deep transfer learning approach","volume":"48","author":"Ampel","year":"2024","journal-title":"MIS Q."},{"key":"10.1016\/j.cose.2026.104873_bib0006","unstructured":"Anvilogic. (2023). FIN7\u2019s growth and evolution: from financial gains to ransomware collaborations."},{"key":"10.1016\/j.cose.2026.104873_bib0007","series-title":"A Methodology for Cyberthreat Ranking: InCorporating the NIST Cybersecurity Framework into FAIR Model","author":"Bakare","year":"2020"},{"key":"10.1016\/j.cose.2026.104873_bib0009","first-page":"1","article-title":"Standardizing cyber threat intelligence information with the structured threat information expression (stix)","volume":"11","author":"Barnum","year":"2012","journal-title":"Mitre Corp."},{"issue":"2","key":"10.1016\/j.cose.2026.104873_bib0010","doi-asserted-by":"crossref","first-page":"315","DOI":"10.1287\/isre.2017.0714","article-title":"Real options models for proactive uncertainty-reducing mitigations and applications in cybersecurity investment decision making","volume":"29","author":"Benaroch","year":"2018","journal-title":"Inf. Syst. Res."},{"issue":"2","key":"10.1016\/j.cose.2026.104873_bib0012","doi-asserted-by":"crossref","first-page":"27","DOI":"10.3316\/QRJ0902027","article-title":"Document analysis as a qualitative research method","volume":"9","author":"Bowen","year":"2009","journal-title":"Qual. Res. J."},{"key":"10.1016\/j.cose.2026.104873_bib0014","doi-asserted-by":"crossref","unstructured":"Carter, N. (2014). The use of triangulation in qualitative research. Number 5\/September 2014, 41(5), 545\u2013547.","DOI":"10.1188\/14.ONF.545-547"},{"issue":"4","key":"10.1016\/j.cose.2026.104873_bib0015","doi-asserted-by":"crossref","first-page":"385","DOI":"10.1016\/j.im.2014.12.004","article-title":"Institutional pressures in security management: direct and indirect influences on organizational investment in information security control resources","volume":"52","author":"Cavusoglu","year":"2015","journal-title":"Inf. Manag."},{"key":"10.1016\/j.cose.2026.104873_bib0017","series-title":"2018 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","first-page":"95","article-title":"Challenges and directions in security information and event management (SIEM)","author":"Cinque","year":"2018"},{"key":"10.1016\/j.cose.2026.104873_bib0018","unstructured":"Commonwealth of Massachusetts. (2022). Experian 2015 data breach: administrative Order of Determination."},{"key":"10.1016\/j.cose.2026.104873_bib0019","unstructured":"Coveware. (2020). Ransomware costs double in Q4 as Ryuk, Sodinokibi proliferate."},{"key":"10.1016\/j.cose.2026.104873_bib0020","article-title":"Big breaches: cybersecurity lessons for everyone","author":"Daswani","year":"2021","journal-title":"Big Breaches"},{"key":"10.1016\/j.cose.2026.104873_bib0021","doi-asserted-by":"crossref","unstructured":"Datto, I. (2016). Datto\u2019s state of the channel ransomware report 2016.","DOI":"10.1155\/2016\/6276348"},{"issue":"1","key":"10.1016\/j.cose.2026.104873_bib0022","doi-asserted-by":"crossref","first-page":"e333","DOI":"10.1002\/spy2.333","article-title":"A threat-intelligence driven methodology to incorporate uncertainty in cyber risk analysis and enhance decision-making","volume":"7","author":"Dekker","year":"2024","journal-title":"Secur. Privacy"},{"key":"10.1016\/j.cose.2026.104873_bib0023","first-page":"6575","article-title":"{DISTDET}: a {cost-effective} distributed Cyber threat detection system","author":"Dong","year":"2023","journal-title":"32nd USENIX Secur. Sympos. (USENIX Secur. 23)"},{"key":"10.1016\/j.cose.2026.104873_bib0025","unstructured":"ENISA. (2025). Enisa cybersecurity threat landscape methodology. https:\/\/doi.org\/10.2824\/1888892."},{"key":"10.1016\/j.cose.2026.104873_bib0027","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2021.102545","article-title":"A system to calculate cyber value-at-risk","volume":"113","author":"Erola","year":"2022","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.104873_bib0028","series-title":"Cyber Intelligence Tradecraft Report: The State of Cyber Intelligence Practices in the United States","author":"Ettinger","year":"2019"},{"key":"10.1016\/j.cose.2026.104873_bib0029","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.103737","article-title":"RCVaR: an economic approach to estimate cyberattacks costs using data from industry reports","volume":"139","author":"Franco","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.104873_bib0030","series-title":"Measuring and Managing Information Risk: a FAIR Approach","author":"Freund","year":"2014"},{"key":"10.1016\/j.cose.2026.104873_bib0031","series-title":"Barriers and Impacts to Adopting Interoperability Standards for Cyber Threat Intelligence Sharing: a Mixed Methods Study","author":"Gong","year":"2017"},{"issue":"7","key":"10.1016\/j.cose.2026.104873_bib0032","doi-asserted-by":"crossref","DOI":"10.1007\/s11432-019-2774-4","article-title":"Malware incident response (IR) informed by cyber threat intelligence (CTI)","volume":"65","author":"He","year":"2022","journal-title":"Sci. China. Inf. Sci."},{"key":"10.1016\/j.cose.2026.104873_bib0033","first-page":"1","article-title":"Enhancing cybersecurity investment with FAIR-ROSI: a responsible cybersecurity approach to digital society","author":"He","year":"2025","journal-title":"Inf. Syst. Front."},{"key":"10.1016\/j.cose.2026.104873_bib0034","article-title":"Analysis of the full costs of cyber security breaches","author":"Heyburn","year":"2020","journal-title":"Ipsos MORI Rep."},{"issue":"2","key":"10.1016\/j.cose.2026.104873_bib0035","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1016\/0950-5849(95)01045-9","article-title":"Expert judgement as an estimating method","volume":"38","author":"Hughes","year":"1996","journal-title":"Inf. Softw. Technol."},{"key":"10.1016\/j.cose.2026.104873_bib0036","unstructured":"IBM. (2016). 2016 Cost of data breach Study: global analysis."},{"key":"10.1016\/j.cose.2026.104873_bib0039","article-title":"Report identifies ransomware\u2019s biggest cost to be business downtime","year":"2016","journal-title":"Intermedia"},{"key":"10.1016\/j.cose.2026.104873_bib0040","series-title":"Information Technology \u2014 Security Techniques \u2014 Information Security Risk Management (ISO\/IEC 27005:2018)","year":"2018"},{"key":"10.1016\/j.cose.2026.104873_bib0042","doi-asserted-by":"crossref","unstructured":"Joint Task Force Transformation Initiative. (2012). Guide for conducting risk assessments (NIST Special Publication 800-30, Revision 1). https:\/\/doi.org\/10.6028\/NIST.SP.800-30r1.","DOI":"10.6028\/NIST.SP.800-30r1"},{"key":"10.1016\/j.cose.2026.104873_bib0043","series-title":"Risk Management for Computer Security: Protecting your Network and Information Assets","author":"Jones","year":"2005"},{"issue":"3","key":"10.1016\/j.cose.2026.104873_bib0046","article-title":"Effective information security requires a balance of social and technology factors","volume":"9","author":"Kayworth","year":"2010","journal-title":"MIS Q. Execut."},{"key":"10.1016\/j.cose.2026.104873_bib0047","first-page":"28","article-title":"Qualitative case study research design: the commonalities and differences between collective, intrinsic and instrumental case studies","volume":"36","author":"Kekeya","year":"2021","journal-title":"Contemp. PNG Stud."},{"key":"10.1016\/j.cose.2026.104873_bib0048","article-title":"Evidence-based prioritization of cybersecurity threats","volume":"6","author":"Kerkdijk","year":"2021","journal-title":"ISACA J."},{"issue":"1","key":"10.1016\/j.cose.2026.104873_bib0050","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1080\/0960085X.2022.2088414","article-title":"Adopting and integrating cyber-threat intelligence in a commercial organisation","volume":"32","author":"Kotsias","year":"2023","journal-title":"Euro. J. Inf. Syst."},{"key":"10.1016\/j.cose.2026.104873_bib0052","doi-asserted-by":"crossref","first-page":"97","DOI":"10.1016\/j.eswa.2018.06.060","article-title":"Aggregation in the analytic hierarchy process: why weighted geometric mean should be used instead of weighted arithmetic mean","volume":"114","author":"Krej\u010d\u00ed","year":"2018","journal-title":"Expert. Syst. Appl."},{"issue":"11","key":"10.1016\/j.cose.2026.104873_bib0053","first-page":"1478","article-title":"Cyber threat intelligence for improving cybersecurity and risk management in critical infrastructure","volume":"25","author":"Kure","year":"2019","journal-title":"J. Univ. Comput. Sci."},{"key":"10.1016\/j.cose.2026.104873_bib0055","series-title":"28th USENIX Security Symposium (USENIX Security 19)","first-page":"851","article-title":"Reading the tea leaves: a comparative analysis of threat intelligence","author":"Li","year":"2019"},{"issue":"1","key":"10.1016\/j.cose.2026.104873_bib0056","doi-asserted-by":"crossref","first-page":"317","DOI":"10.25300\/MISQ\/2022\/15713","article-title":"Where is IT in information security? The interrelationship among IT investment, security awareness, and data breaches","volume":"47","author":"Li","year":"2023","journal-title":"MIS Q."},{"issue":"2","key":"10.1016\/j.cose.2026.104873_bib0057","first-page":"407","article-title":"Statistical analysis of masked data","volume":"9","author":"Little","year":"1993","journal-title":"J. Off. Stat."},{"key":"10.1016\/j.cose.2026.104873_bib0059","article-title":"Equifax says data breach has cost it nearly $2 billion so far","author":"Meltzer","year":"2020","journal-title":"Atlanta Bus. Chronicle"},{"key":"10.1016\/j.cose.2026.104873_bib0044","series-title":"Orange: Hackers Nab Data from 800,000 Clients","author":"Melvin","year":"2014"},{"key":"10.1016\/j.cose.2026.104873_bib0060","series-title":"ACM International Conference Proceeding Series","article-title":"Ontology-based cyber risk monitoring using cyber threat Intelligence","author":"Merah","year":"2021"},{"key":"10.1016\/j.cose.2026.104873_bib0061","doi-asserted-by":"crossref","unstructured":"Mori, I., Heyburn, H., Whitehead, A., Zanobetti, L., Shah, J.N., & Furnell, S. (2020). Analysis of the full costs of cyber security breaches Analysis of the full costs of cyber security breaches literature review annex.","DOI":"10.1016\/S1361-3723(20)30127-5"},{"key":"10.1016\/j.cose.2026.104873_bib0063","doi-asserted-by":"crossref","unstructured":"NIST. (2012). NIST Special publication 800-30 revision 1. https:\/\/doi.org\/10.6028\/NIST.SP.800-30r1.","DOI":"10.6028\/NIST.SP.800-30r1"},{"key":"10.1016\/j.cose.2026.104873_bib0065","article-title":"A hybrid FAIR and XGBoost framework for cyber-risk intelligence and expected loss prediction","author":"Nwafor","year":"2025","journal-title":"Expert. Syst. Appl."},{"key":"10.1016\/j.cose.2026.104873_bib0066","series-title":"2015 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (Cybersa)","first-page":"1","article-title":"Cyber security operations centre: security monitoring for protecting business and supporting cyber defense strategy","author":"Onwubiko","year":"2015"},{"issue":"1","key":"10.1016\/j.cose.2026.104873_bib0067","doi-asserted-by":"crossref","first-page":"83","DOI":"10.1111\/j.1539-6924.1992.tb01310.x","article-title":"Expert judgment in risk analysis and management: process, context, and pitfalls","volume":"12","author":"Otway","year":"1992","journal-title":"Risk Anal."},{"issue":"5 Pt 2","key":"10.1016\/j.cose.2026.104873_bib0068","first-page":"1189","article-title":"Enhancing the quality and credibility of qualitative analysis","volume":"34","author":"Patton","year":"1999","journal-title":"Health Serv. Res."},{"key":"10.1016\/j.cose.2026.104873_bib0069","series-title":"Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference","author":"Pearl","year":"2014"},{"key":"10.1016\/j.cose.2026.104873_bib0070","article-title":"Stix V2.1","author":"Piazza","year":"2021","journal-title":"OASIS Standard"},{"key":"10.1016\/j.cose.2026.104873_bib0071","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1016\/j.cose.2017.02.005","article-title":"Data-driven analytics for cyber-threat intelligence and information sharing","volume":"67","author":"Qamar","year":"2017","journal-title":"Comput. Secur."},{"issue":"6","key":"10.1016\/j.cose.2026.104873_bib0072","doi-asserted-by":"crossref","first-page":"715","DOI":"10.1007\/s10207-019-00433-2","article-title":"Leveraging cyber threat intelligence for a dynamic risk framework: automation by using a semantic reasoner and a new combination of standards (STIXTM, SWRL and OWL)","volume":"18","author":"Riesco","year":"2019","journal-title":"Int. J. Inf. Secur."},{"key":"10.1016\/j.cose.2026.104873_bib0073","series-title":"Cyber Risk Quantification","year":"2023"},{"key":"10.1016\/j.cose.2026.104873_bib0074","series-title":"Special Publication (NIST SP)","article-title":"Guide for conducting risk assessments","author":"Ross","year":"2012"},{"key":"10.1016\/j.cose.2026.104873_bib0075","article-title":"NIST CSF 2.0 and the cybersecurity hierarchy","volume":"1","author":"ROSS","year":"2025","journal-title":"ISACA J."},{"key":"10.1016\/j.cose.2026.104873_bib0077","series-title":"What is Magecart?","year":"2024"},{"key":"10.1016\/j.cose.2026.104873_bib0079","doi-asserted-by":"crossref","first-page":"783","DOI":"10.1016\/j.procs.2024.05.166","article-title":"FAIR: cyber security risk quantification in logistics sector","volume":"237","author":"Seid","year":"2024","journal-title":"Procedia Comput. Sci."},{"key":"10.1016\/j.cose.2026.104873_bib0080","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1016\/j.cose.2015.11.001","article-title":"Taxonomy of information security risk assessment (ISRA)","volume":"57","author":"Shameli-Sendi","year":"2016","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.104873_bib0081","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2020.101761","article-title":"A review and theoretical explanation of the \u2018Cyberthreat-Intelligence (CTI) capability\u2019that needs to be fostered in information security practitioners and how this can be accomplished","volume":"92","author":"Shin","year":"2020","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.104873_bib0082","series-title":"Collaborative Cyber Threat Intelligence: Detecting and Responding to Advanced Cyber Attacks at the National Level","author":"Skopik","year":"2017"},{"key":"10.1016\/j.cose.2026.104873_bib0083","doi-asserted-by":"crossref","first-page":"503","DOI":"10.2307\/25750689","article-title":"User participation in information systems security risk management","author":"Spears","year":"2010","journal-title":"MIS Quarterly"},{"key":"10.1016\/j.cose.2026.104873_bib0085","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2020.101734","article-title":"APT datasets and attack modeling for automated detection methods: a review","volume":"92","author":"Stojanovi\u0107","year":"2020","journal-title":"Comput. Secur."},{"issue":"3","key":"10.1016\/j.cose.2026.104873_bib0086","doi-asserted-by":"crossref","first-page":"1748","DOI":"10.1109\/COMST.2023.3273282","article-title":"Cyber threat intelligence mining for proactive cybersecurity defense: a survey and new perspectives","volume":"25","author":"Sun","year":"2023","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"10.1016\/j.cose.2026.104873_bib0087","unstructured":"Target Corporation. (2016). 2015 annual report."},{"key":"10.1016\/j.cose.2026.104873_bib0088","unstructured":"Target Cyber Attack: A Columbia University Case Study. (2022)."},{"key":"10.1016\/j.cose.2026.104873_bib0089","unstructured":"The Home Depot, Inc. (2016). 2016 annual report."},{"key":"10.1016\/j.cose.2026.104873_bib0090","author":"Tucker"},{"key":"10.1016\/j.cose.2026.104873_bib0091","unstructured":"Verizon. (2016). 2016 data breach investigations report."},{"key":"10.1016\/j.cose.2026.104873_bib0092","unstructured":"Vice Society. (2023, August 1). Wikipedia."},{"key":"10.1016\/j.cose.2026.104873_bib0041","article-title":"2017 Data breach will cost Equifax at least $1.38 billion","author":"Vijayan","year":"2020","journal-title":"Dark Read."},{"issue":"3","key":"10.1016\/j.cose.2026.104873_bib0094","article-title":"Cybersecurity incident handling: a case study of the Equifax data breach","volume":"19","author":"Wang","year":"2018","journal-title":"Issues Inf. Syst."},{"key":"10.1016\/j.cose.2026.104873_bib0095","series-title":"ACM SIGSAC Conference on Computer and Communications Security (CCS \u201924)","article-title":"Poster: cyber security economics model (CYSEM)","author":"Xin","year":"2024"},{"key":"10.1016\/j.cose.2026.104873_bib0096","doi-asserted-by":"crossref","first-page":"754","DOI":"10.1016\/j.future.2018.12.033","article-title":"Framework for calculating return on security investment (ROSI) for security-oriented organizations","volume":"95","author":"Yaqoob","year":"2019","journal-title":"Fut. Gener. Comput. Syst."}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826000490?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826000490?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,3,24]],"date-time":"2026-03-24T14:17:44Z","timestamp":1774361864000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404826000490"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6]]},"references-count":76,"alternative-id":["S0167404826000490"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2026.104873","relation":{},"ISSN":["0167-4048"],"issn-type":[{"value":"0167-4048","type":"print"}],"subject":[],"published":{"date-parts":[[2026,6]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"A cyber risk economics model for organization-wide risk management (CYREM-ORM)","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2026.104873","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"Crown Copyright \u00a9 2026 Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"104873"}}