{"id":"98b12079-5882-4155-8bc2-1de795c9f7e4","arxiv_id":"2504.17054","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":2.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"The paper restates the existing scenario-based Cyber Value-at-Risk formula with extra subscripts for IoT layers, without adding data, derivation, or validation.","lead":"This paper proposes applying Cyber Value-at-Risk, a financial metric, to each layer of an Internet of Things system by multiplying scenario probabilities by expected financial losses. The result is a short conceptual note: the math is a re-labeled version of the existing formula, with no data or case study.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. 2 replaces the quantile-based VaR of Eq. 1 with an expected-loss product without derivation, so the central Cy-VaR model is internally inconsistent and the layer extension inherits this flaw.","rationale":"The reader's weakest-assumption analysis correctly identifies that Eq. 2 silently substitutes expected loss for the quantile-based VaR of Eq. 1. This is the single most load-bearing concern because every downstream quantity—Total CyVaR and the layer-specific CyVaR_j—is built from Eq. 2. If Eq. 2 is not a valid VaR, the paper's contribution is not an extension of Cy-VaR but a re-labeling of a simple expected-loss calculation; the layer partition adds no mathematical content and the claimed investment-prioritization benefit is unsupported by any data. The numerical example above shows the discrepancy is not a technicality: for a common two-outcome scenario, Eq. 3 gives $100,000 while the VaR of Eq. 1 is $1,000,000, an order-of-magnitude difference. This is an internal inconsistency, not a mere departure from field consensus. The paper also provides no empirical application, but the mathematical flaw is sufficient to justify rejection. The reader's verdict of REJECT remains appropriate, so no adjustment is needed.","tokens_in":5163,"tokens_out":2374,"duration_ms":22820,"concrete_test":"Take a two-point loss distribution: with probability p=0.1, loss L=$1,000,000, otherwise zero. Compute Eq. 1 for alpha=0.95: since P(L > 999,999) = 0.1 > 0.05, the infimum is 1,000,000, so VaR_0.95 = $1,000,000. Eq. 2 gives CyVaR = 0.1 * 1,000,000 = $100,000, and Eq. 3 sums to $100,000. This demonstrates that the paper's Total CyVaR is not the VaR defined in Eq. 1, and no derivation in the paper reconciles the two. Re-run this calculation for any scenario set; if the paper's intended risk measure differs from the quantile VaR by orders of magnitude in realistic cases, the central modeling claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section IV-A defines VaR in Eq. 1 as a quantile infimum: VaR_alpha(L) = inf{l : P(L > l) <= 1-alpha}. It then states, without derivation, that CyVaR_i = P_i * L_i (Eq. 2) and Total CyVaR = sum_i P_i * L_i (Eq. 3). These are not equivalent. For a loss with probability p of losing L and otherwise zero, Eq. 1 gives VaR_alpha = L if p > 1-alpha and 0 otherwise, whereas Eq. 2 gives pL. They coincide only when p approaches 1 or alpha approaches 1 with p fixed, not in the general scenario framework the paper claims. Thus Total CyVaR as computed is an expected loss, not a Value at Risk. The layer-specific extension (Eqs. 4-5) is merely a partition of this expected-loss sum by IoT layer; it does not bridge the gap to Eq. 1. Since the paper's stated goal is to extend Cy-VaR and use it to prioritize security investments, the central measure is mislabeled. The model could still serve as a heuristic expected-loss score, but that is a different claim, and no data or case study is provided to validate its prioritization utility.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a 'Cyber Value at Risk' (Cy-VaR) model for IoT security investment decisions. It reviews 3-, 4-, and 5-layer IoT architectures, discusses U.S. IoT regulation, and then presents a mathematical model in Section IV-A: Eq. (2) defines CyVaR_i as the product of scenario probability P_i and financial loss L_i, Eq. (3) sums these over scenarios, and Eqs. (4)-(5) extend this to a layer-specific decomposition for the perception, network, and application layers. The stated contribution is extending Cy-VaR to IoT layers so that organizations can prioritize security investments effectively.","tokens_in":5360,"tokens_out":2839,"duration_ms":23856,"significance":"If the proposed measure were a valid representation of Value at Risk and were accompanied by a method for estimating P_ij and L_ij, the layer-wise decomposition could be a useful practical tool for risk communication. The paper's exposition of IoT architectures is clear and accessible, and the references to cybersecurity economics provide relevant background. However, the central quantity is simply an expected loss, not a VaR, and the layer extension is a trivial partition of the same sum. Without empirical validation or a demonstration that the scores improve investment decisions, the paper's practical contribution is unsupported. The manuscript does not meet the bar for a publishable research result in its current form.","major_comments":[{"comment":"Equation (2) defines CyVaR_i as P_i × L_i, but this is the expected loss of scenario i, not the Value at Risk defined in Eq. (1) as an infimum quantile of the loss distribution. For a single scenario with loss L occurring with probability p and zero otherwise, Eq. (1) yields VaR_α = L if p > 1−α and 0 otherwise, whereas Eq. (2) yields pL. The two quantities coincide only in special cases (e.g., p close to 1 or α close to 1 with p fixed), so the paper's central measure is mislabeled as Value at Risk. The confidence level α is never specified or used in Eqs. (2)-(5), severing the connection to Eq. (1).","section":"Section IV-A, Eqs. (1)-(3)"},{"comment":"Equation (5) is algebraically identical to Eq. (3) when the scenario set is partitioned by layer: each scenario i belongs to exactly one layer j, so summing P_ij × L_ij over j and i equals summing P_i × L_i over i. The layer extension introduces no new modeling content; it only groups the same product terms. Additionally, the paper does not explain how P_ij and L_ij are to be estimated or how the decomposition would change an investment decision relative to an unlayered expected-loss score.","section":"Section IV-A, Eqs. (4)-(5)"},{"comment":"The conclusion states that calculating Cy-VaR for each layer enables organizations to prioritize security investments effectively, but the paper contains no data, case study, or comparative evaluation supporting this claim. Without any demonstration that the layer-specific scores lead to better decisions than existing risk matrices or expected-loss scoring, the practical contribution is unsubstantiated.","section":"Section V, Conclusion"}],"minor_comments":[{"comment":"The title and text contain spacing artifacts such as 'V alue' and 'Y at Risk' that should be corrected in any revised version.","section":"Title and Abstract"},{"comment":"The word 'impatcing' in the Introduction should be 'impacting'.","section":"Introduction"},{"comment":"Reference [1] is cited for the definition of IoT devices, but the cited IoT Cybersecurity Improvement Act does not contain that definition; the source of the definition should be properly attributed (e.g., NISTIR 8259).","section":"References"},{"comment":"The paper never specifies a confidence level α for the VaR in Eq. (1), nor does it discuss how scenario probabilities P_i are derived (e.g., expert elicitation, historical data, attack trees), which limits reproducibility.","section":"Section IV-A"},{"comment":"The discussion of Monte Carlo simulations and agent-based modeling is speculative and not tied to the proposed formulation; this is presentation rather than a concrete research direction.","section":"Section VI"}],"recommendation":"reject","confidential_remarks":"This manuscript appears to be a preliminary workshop-style note rather than a complete research paper. The central measure is not a Value at Risk, the layer-wise extension is a notational partition, and there is no evaluation. If the authors wish to pursue a practical risk-scoring tool, they would need to re-scope as an expected-loss framework, provide estimation procedures, and validate against real or synthetic data. The paper's current framing would likely mislead practitioners who expect a quantile-based risk measure."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is not a research contribution in its current form. The one new piece—Eqs. 4 and 5—is a partition of the scenario space by IoT layer. That is a re-labeling of the Cy-VaR formula the authors cite, not an extension that yields new estimates or testable predictions. The paper is clearly written and does a decent job summarizing 3/4/5-layer IoT architectures and the regulation context, so it might work as a teaching note or as background for a longer paper. But the core model has a problem the authors never address: Eq. 1 defines VaR as a quantile of the loss distribution, while Eq. 2 defines CyVaR_i as P_i * L_i, an expected loss. These are different objects. For a scenario with loss L occurring with probability p and zero otherwise, the quantile VaR at confidence alpha is L if p > 1-alpha, and 0 otherwise, not pL. The paper gives no derivation justifying why the expected-loss product is a valid stand-in for VaR. The cited source, Orlando (2021), may use a scenario-based formulation, but the authors need to engage with the distinction rather than assert equivalence. Because the layer extension just sums the same expected-loss products over a finer partition, the mislabeling carries through. There is also no empirical application or case study, so there is no evidence that ranking layers by this score improves investment decisions. The conclusion overclaims: 'demonstrated' is too strong for a paper with no data and no validation. On the positive side, the references are standard and relevant, and the writing is accessible. But the central measure is mislabeled and the extension is notational. I would not send this to peer review as-is. If the authors want to rescue it, they need to either derive a legitimate layer-specific VaR from the quantile definition, or explicitly reframe the whole thing as an expected-loss scoring heuristic and test it on real data. As a desk decision: reject.","headline":"A short conceptual note that re-indexes scenario-based expected loss as 'layer-specific Cy-VaR' without ever bridging the gap between VaR as a quantile and the expected-loss product it actually computes.","tokens_in":5933,"tokens_out":1733,"would_cite":false,"duration_ms":16044,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper reduces IoT cyber-risk prioritization to a layer-by-layer expected-dollar-loss sum.","keywords":["Internet of Things (IoT)","Cybersecurity","Risk Assessment","Value at Risk (VaR)","Cyber Value-at-Risk (Cy-VaR)","IoT layers","Security Investment","Expected loss"],"falsifier":"Simulate two IoT layers with equal mean loss but different tail behavior, for example a perception layer with frequent small losses and an application layer with rare extreme losses, then compute the paper's $\\sum_j\\sum_i P_{ij}L_{ij}$ and compare it with the 95% Value at Risk of the combined loss distribution. If the layer ranked first by the double sum is not the layer that dominates the 95% quantile, the claim that the model identifies where risk concentrates fails.","tokens_in":4917,"feed_emoji":"📉","tokens_out":9346,"duration_ms":77074,"temperature":0.7,"pith_summary":"The paper argues that the Cyber Value-at-Risk (Cy-VaR) measure, a scenario-based calculation used to express cyber risk in dollars, can be applied separately to the three layers of an IoT architecture: perception, network, and application. For each layer $j$ and scenario $i$, the model sets $\\mathrm{CyVaR}_{ij}=P_{ij}\\times L_{ij}$ and sums over scenarios and layers to obtain total exposure. If the extension holds, a security officer can compare risks across layers on a single monetary scale and rank investments by which layer contributes the most expected dollar loss. The stated payoff is a budgeting heuristic: spend where the layer-scenario sum is largest.","feed_headline":"IoT cyber risk becomes a per-layer dollar figure","feed_subtitle":"A Cy-VaR extension ranks perception, network, and application losses so CIOs can prioritize security spending.","key_machinery":"The carrying object is the layer-scenario Cy-VaR cell, defined as $\\mathrm{CyVaR}_{ij}=P_{ij}\\times L_{ij}$. It does the work by turning the three-layer IoT architecture and a set of scenarios into one additive monetary quantity; the total exposure is simply the double sum over layers and scenarios. The architecture gives the partition, and the Cy-VaR formula gives the common dollar units.","core_discovery":"The central claim is a decomposition, not a new statistical estimator: take the previously defined total Cy-VaR, $\\sum_i (P_i\\times L_i)$, and index both probability and loss by IoT layer, yielding $\\mathrm{CyVaR}_{ij}=P_{ij}\\times L_{ij}$ and $\\mathrm{TotalCyVaR}=\\sum_j\\sum_i \\mathrm{CyVaR}_{ij}$. The perception layer covers sensors and actuators, the network layer covers data transport, and the application layer covers user-facing services. The paper claims that computing this value per layer reveals where financial risk concentrates and therefore which layer deserves priority in security investment.","pith_inferences":["Because the formula is an expected-loss sum, it will under-weight rare catastrophic IoT losses unless the probability inputs are themselves tail-adjusted; the paper does not address tail behavior.","The layer partition assumes a loss can be assigned cleanly to one layer, whereas many real attacks cascade from a compromised sensor to network exfiltration to application damage, so joint or conditional probabilities would be needed for those cases.","The prioritization claim is testable: compare layer-level rankings from this model against breach-cost data segmented by device tier or IoT layer, something the paper does not do.","Monte Carlo and agent-based simulation, which the paper lists as future work, are natural next steps because they would supply the $P_{ij}$ inputs the formula requires."],"forward_implications":["A chief information officer can rank the perception, network, and application layers by their summed $\\mathrm{CyVaR}_{ij}$ values and allocate security budget to the top-ranked layer.","Heterogeneous risks, such as sensor tampering, data interception, and application exploits, become comparable because each is reduced to an expected dollar loss.","Existing scenario and vignette exercises can feed the model, since each scenario only needs a probability and a loss estimate per layer.","If the per-layer inputs are consistent, the layer totals add back to the original whole-ecosystem Cy-VaR, so the layer decomposition is a refinement rather than a separate risk measure."],"supporting_citations":[{"why":"Defines the three-layer IoT architecture (perception, network, application) that the decomposition partitions risk across.","marker":"[5]"},{"why":"Supplies the probabilistic total Cy-VaR definition, $\\sum_i P_i L_i$, which the paper generalizes to two indices.","marker":"[12]"},{"why":"Introduces Cy-VaR as a scenario-based cyber risk measure, the framework the paper extends.","marker":"[13]"},{"why":"Provides the formal Value-at-Risk quantile definition restated in the paper's Eq. 1.","marker":"[14]"}],"fun_headline_variants":["IoT cyber losses ranked by layer in dollar terms","Per-layer Cy-VaR turns IoT risk into budget priorities","Layer-by-layer dollar risk for smarter IoT security spend","IoT risk: a dollar figure for each layer, not just total"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The model assumes that $\\mathrm{CyVaR}_{ij}=P_{ij}\\times L_{ij}$ is an acceptable stand-in for Value at Risk, even though the formal VaR definition earlier in the paper is a tail quantile of the loss distribution; if expected loss is not the intended quantity, the layer ranking is a ranking of expected losses rather than of value at risk.","fun_headline_variants_meta":{"raw":{"variants":["IoT cyber losses ranked by layer in dollar terms","Per-layer Cy-VaR turns IoT risk into budget priorities","Layer-by-layer dollar risk for smarter IoT security spend","IoT risk: a dollar figure for each layer, not just total"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00053,"raw_usage":{"total_tokens":2490,"prompt_tokens":820,"completion_tokens":1670,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":436,"completion_tokens_details":{"reasoning_tokens":1603}},"tokens_in":436,"tokens_out":1670,"duration_ms":10604,"temperature":1.0,"reasoning_tokens":1603,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:50:32.168467+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Simulate two IoT layers with equal mean loss but different tail behavior, for example a perception layer with frequent small losses and an application layer with rare extreme losses, then compute the paper's $\\sum_j\\sum_i P_{ij}L_{ij}$ and compare it with the 95% Value at Risk of the combined loss distribution. If the layer ranked first by the double sum is not the layer that dominates the 95% quantile, the claim that the model identifies where risk concentrates fails.","supporting_citations":[{"cited_title":"IoT eleme nts, layered architectures and security issues: A comprehe nsive survey,","cited_arxiv_id":null,"evidence_quote":"Defines the three-layer IoT architecture (perception, network, application) that the decomposition partitions risk across."},{"cited_title":"Cyber risk quantification: Investigating the role of cyber value at risk,","cited_arxiv_id":null,"evidence_quote":"Supplies the probabilistic total Cy-VaR definition, $\\sum_i P_i L_i$, which the paper generalizes to two indices."},{"cited_title":"The benefits and limits of cyber value-at-ri sk,","cited_arxiv_id":null,"evidence_quote":"Introduces Cy-VaR as a scenario-based cyber risk measure, the framework the paper extends."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the formal Value-at-Risk quantile definition restated in the paper's Eq. 1."}],"review_version":1}