Data-Driven Evaluation of Cybersecurity Costs in The Digital Era: Managerial Implications for IT Companies

Abstract

In the digital era, cybersecurity has become a critical managerial concern for IT companies, as cyber risks increasingly affect financial performance, operational continuity, and strategic decision-making. This study proposes a data-driven approach to evaluating and managing cybersecurity costs by integrating cyber risk forecasting with multi-criteria decision analysis. Using the Global Cost of Cyber Risk Calculator and firm-level proportional estimation, the study forecasts potential cyber-attack losses for the Lithuanian IT sector and a representative IT company over the period 2025–2029. Survey data from IT and finance managers are further analysed using the TOPSIS method to prioritise cybersecurity investment strategies. The results indicate a substantial growth in projected cyber-attack costs, highlighting the need for proactive and structured cybersecurity investment decisions. Among alternative measures, advanced firewall and intrusion detection systems, secure network architecture, and employee training emerge as the most effective strategies for reducing cyber risk exposure. This study contributes to the literature on management changes in the digital era by demonstrating how data-driven risk assessment tools can support managerial decision-making in cybersecurity investment. Practically, the findings provide IT managers with a structured framework for allocating cybersecurity resources more effectively in the face of increasing digital uncertainty.