Cyber Value At Risk Model for IoT Ecosystems

Emrah Ugurlu; Goksel Kucukkaya; Murat Ozer

REVIEW 3 major objections 5 minor 14 references

Cyber Value At Risk Model for IoT Ecosystems

T0 review · 3 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper reduces IoT cyber-risk prioritization to a layer-by-layer expected-dollar-loss sum.

desk verdict A short conceptual note that re-indexes scenario-based expected loss as 'layer-specific Cy-VaR' without ever bridging the gap between VaR as a quantile and the expected-loss product it actually computes. read the letter →

arxiv 2504.17054 v1 pith:RFVQQ3TW submitted 2025-04-23 cs.CY

Goksel Kucukkaya , Murat Ozer , Emrah Ugurlu This is my paper · ORCID

classification cs.CY

keywords InternetofThings(IoT)CybersecurityRiskAssessmentValueat(VaR)CyberValue-at-Risk(Cy-VaIoTlayersSecurityInvestmentExpectedloss

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the Cyber Value-at-Risk (Cy-VaR) measure, a scenario-based calculation used to express cyber risk in dollars, can be applied separately to the three layers of an IoT architecture: perception, network, and application. For each layer $j$ and scenario $i$, the model sets $\mathrm{CyVaR}_{ij}=P_{ij}\times L_{ij}$ and sums over scenarios and layers to obtain total exposure. If the extension holds, a security officer can compare risks across layers on a single monetary scale and rank investments by which layer contributes the most expected dollar loss. The stated payoff is a budgeting heuristic: spend where the layer-scenario sum is largest.

What carries the argument

The carrying object is the layer-scenario Cy-VaR cell, defined as $\mathrm{CyVaR}_{ij}=P_{ij}\times L_{ij}$. It does the work by turning the three-layer IoT architecture and a set of scenarios into one additive monetary quantity; the total exposure is simply the double sum over layers and scenarios. The architecture gives the partition, and the Cy-VaR formula gives the common dollar units.

What would settle it

Simulate two IoT layers with equal mean loss but different tail behavior, for example a perception layer with frequent small losses and an application layer with rare extreme losses, then compute the paper's $\sum_j\sum_i P_{ij}L_{ij}$ and compare it with the 95% Value at Risk of the combined loss distribution. If the layer ranked first by the double sum is not the layer that dominates the 95% quantile, the claim that the model identifies where risk concentrates fails.

Watch

Extended reading notes

Core claim

The central claim is a decomposition, not a new statistical estimator: take the previously defined total Cy-VaR, $\sum_i (P_i\times L_i)$, and index both probability and loss by IoT layer, yielding $\mathrm{CyVaR}_{ij}=P_{ij}\times L_{ij}$ and $\mathrm{TotalCyVaR}=\sum_j\sum_i \mathrm{CyVaR}_{ij}$. The perception layer covers sensors and actuators, the network layer covers data transport, and the application layer covers user-facing services. The paper claims that computing this value per layer reveals where financial risk concentrates and therefore which layer deserves priority in security investment.

Load-bearing premise

The model assumes that $\mathrm{CyVaR}_{ij}=P_{ij}\times L_{ij}$ is an acceptable stand-in for Value at Risk, even though the formal VaR definition earlier in the paper is a tail quantile of the loss distribution; if expected loss is not the intended quantity, the layer ranking is a ranking of expected losses rather than of value at risk.

Editorial extensions

If this is right

A chief information officer can rank the perception, network, and application layers by their summed $\mathrm{CyVaR}_{ij}$ values and allocate security budget to the top-ranked layer.
Heterogeneous risks, such as sensor tampering, data interception, and application exploits, become comparable because each is reduced to an expected dollar loss.
Existing scenario and vignette exercises can feed the model, since each scenario only needs a probability and a loss estimate per layer.
If the per-layer inputs are consistent, the layer totals add back to the original whole-ecosystem Cy-VaR, so the layer decomposition is a refinement rather than a separate risk measure.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because the formula is an expected-loss sum, it will under-weight rare catastrophic IoT losses unless the probability inputs are themselves tail-adjusted; the paper does not address tail behavior.
The layer partition assumes a loss can be assigned cleanly to one layer, whereas many real attacks cascade from a compromised sensor to network exfiltration to application damage, so joint or conditional probabilities would be needed for those cases.
The prioritization claim is testable: compare layer-level rankings from this model against breach-cost data segmented by device tier or IoT layer, something the paper does not do.
Monte Carlo and agent-based simulation, which the paper lists as future work, are natural next steps because they would supply the $P_{ij}$ inputs the formula requires.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is not a research contribution in its current form. The one new piece—Eqs. 4 and 5—is a partition of the scenario space by IoT layer. That is a re-labeling of the Cy-VaR formula the authors cite, not an extension that yields new estimates or testable predictions. The paper is clearly written and does a decent job summarizing 3/4/5-layer IoT architectures and the regulation context, so it might work as a teaching note or as background for a longer paper. But the core model has a problem the authors never address: Eq. 1 defines VaR as a quantile of the loss distribution, while Eq. 2 defines CyVaR_i as P_i * L_i, an expected loss. These are different objects. For a scenario with loss L occurring with probability p and zero otherwise, the quantile VaR at confidence alpha is L if p > 1-alpha, and 0 otherwise, not pL. The paper gives no derivation justifying why the expected-loss product is a valid stand-in for VaR. The cited source, Orlando (2021), may use a scenario-based formulation, but the authors need to engage with the distinction rather than assert equivalence. Because the layer extension just sums the same expected-loss products over a finer partition, the mislabeling carries through. There is also no empirical application or case study, so there is no evidence that ranking layers by this score improves investment decisions. The conclusion overclaims: 'demonstrated' is too strong for a paper with no data and no validation. On the positive side, the references are standard and relevant, and the writing is accessible. But the central measure is mislabeled and the extension is notational. I would not send this to peer review as-is. If the authors want to rescue it, they need to either derive a legitimate layer-specific VaR from the quantile definition, or explicitly reframe the whole thing as an expected-loss scoring heuristic and test it on real data. As a desk decision: reject.

Referee Report

3 major / 5 minor

Summary. The paper proposes a 'Cyber Value at Risk' (Cy-VaR) model for IoT security investment decisions. It reviews 3-, 4-, and 5-layer IoT architectures, discusses U.S. IoT regulation, and then presents a mathematical model in Section IV-A: Eq. (2) defines CyVaR_i as the product of scenario probability P_i and financial loss L_i, Eq. (3) sums these over scenarios, and Eqs. (4)-(5) extend this to a layer-specific decomposition for the perception, network, and application layers. The stated contribution is extending Cy-VaR to IoT layers so that organizations can prioritize security investments effectively.

Significance. If the proposed measure were a valid representation of Value at Risk and were accompanied by a method for estimating P_ij and L_ij, the layer-wise decomposition could be a useful practical tool for risk communication. The paper's exposition of IoT architectures is clear and accessible, and the references to cybersecurity economics provide relevant background. However, the central quantity is simply an expected loss, not a VaR, and the layer extension is a trivial partition of the same sum. Without empirical validation or a demonstration that the scores improve investment decisions, the paper's practical contribution is unsupported. The manuscript does not meet the bar for a publishable research result in its current form.

major comments (3)

[Section IV-A, Eqs. (1)-(3)] Equation (2) defines CyVaR_i as P_i × L_i, but this is the expected loss of scenario i, not the Value at Risk defined in Eq. (1) as an infimum quantile of the loss distribution. For a single scenario with loss L occurring with probability p and zero otherwise, Eq. (1) yields VaR_α = L if p > 1−α and 0 otherwise, whereas Eq. (2) yields pL. The two quantities coincide only in special cases (e.g., p close to 1 or α close to 1 with p fixed), so the paper's central measure is mislabeled as Value at Risk. The confidence level α is never specified or used in Eqs. (2)-(5), severing the connection to Eq. (1).
[Section IV-A, Eqs. (4)-(5)] Equation (5) is algebraically identical to Eq. (3) when the scenario set is partitioned by layer: each scenario i belongs to exactly one layer j, so summing P_ij × L_ij over j and i equals summing P_i × L_i over i. The layer extension introduces no new modeling content; it only groups the same product terms. Additionally, the paper does not explain how P_ij and L_ij are to be estimated or how the decomposition would change an investment decision relative to an unlayered expected-loss score.
[Section V, Conclusion] The conclusion states that calculating Cy-VaR for each layer enables organizations to prioritize security investments effectively, but the paper contains no data, case study, or comparative evaluation supporting this claim. Without any demonstration that the layer-specific scores lead to better decisions than existing risk matrices or expected-loss scoring, the practical contribution is unsubstantiated.

minor comments (5)

[Title and Abstract] The title and text contain spacing artifacts such as 'V alue' and 'Y at Risk' that should be corrected in any revised version.
[Introduction] The word 'impatcing' in the Introduction should be 'impacting'.
[References] Reference [1] is cited for the definition of IoT devices, but the cited IoT Cybersecurity Improvement Act does not contain that definition; the source of the definition should be properly attributed (e.g., NISTIR 8259).
[Section IV-A] The paper never specifies a confidence level α for the VaR in Eq. (1), nor does it discuss how scenario probabilities P_i are derived (e.g., expert elicitation, historical data, attack trees), which limits reproducibility.
[Section VI] The discussion of Monte Carlo simulations and agent-based modeling is speculative and not tied to the proposed formulation; this is presentation rather than a concrete research direction.

Circularity Check

2 steps flagged · score 8.0 of 10

Layer computation is the original expected-loss sum re-indexed by IoT layer; the VaR label is asserted, not derived.

renaming known result [Section IV-A, Eqs. (1)-(2)]
"The Cy-V aR can be represented mathematically as [14]: V aRα (L) = inf {l ∈ R|P (L > l ) ≤ 1 − α } (1) ... It is more convenient to work with scenarios and vignettes, making table top exercises and capture the ﬂag exercises useful in value at risk calculations. ... For each scenario i, calculate the CyV aR as the product of its probability Pi and its associated ﬁnancial loss Li: CyV aRi = Pi × Li (2)"

Equation (1) defines VaR as an infimum over loss thresholds of a tail probability. Equation (2) then sets CyVaR_i = P_i × L_i, a probability-weighted loss. The paper supplies no derivation that this product equals the quantile VaR, and the two are not generally equal: for a loss L occurring with probability p, the quantile VaR is L when p > 1-alpha and 0 otherwise, whereas the product is pL. Thus the subsequent calculation is an expected-loss sum renamed as 'Value at Risk'; the label, rather than a derived equivalence, carries the claim that the model quantifies cyber VaR.
self definitional [Section IV-A, Eqs. (4)-(5)]
"For each IoT layer j (where j represents perception, network, and application) and scenario i, calculate the layer-speciﬁc CyV aR as: CyV aRij = Pij × Lij (4) ... To obtain the total probabilistic CyV aR across all IoT layers and scenarios, sum up the individual CyV aR values: Total CyV aR= ∑ j ∑ i CyV aRij = ∑ j ∑ i (Pij × Lij) (5)"

Equation (5) is Eq. (3) with the scenario index replaced by the pair (j,i). If each scenario is assigned to exactly one IoT layer, the double sum is the same sum as Eq. (3): every scenario contributes P_ij × L_ij once. If a scenario can occur in multiple layers, Eq. (5) is a new definition, not a derivation from the previous total. Either way, the layer-specific Cy-VaR is not a predicted consequence of the model; it is the definitional summand chosen by the user. The claimed extension to IoT layers therefore reduces to partitioning or re-indexing the original scenario loss sum, with no additional constraint, estimation, or test.

full rationale

The paper contains no fitted parameters, no empirical data, and no load-bearing self-citations; its mathematical content is entirely definitional. The central derivation chain is: Eq. (1) states the quantile definition of VaR; Eq. (2) replaces that definition with the product P_i × L_i; Eq. (3) sums those products over scenarios. The claimed IoT-layer extension, Eqs. (4)-(5), simply adds a layer subscript j to the same product and sums over j as well. If the layer-scenario pairs partition the scenario set, Eq. (5) is exactly Eq. (3) by construction; if they do not partition it, Eq. (5) is a newly chosen definition rather than a derived result. Either way, the extension does not derive anything from the original Cy-VaR model, and the model itself is an expected-loss calculation relabeled as Value at Risk. Because the paper's main contribution, the layer-specific Cy-VaR, is forced by definition and the VaR label is an unproven renaming, the circularity score is high.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper introduces no fitted parameters and no new entities. Its layer-specific model depends entirely on user-supplied probabilities and losses, plus the unstated assumption that the product P*L is a valid stand-in for Value at Risk and that layer risks are additive. These assumptions are implicit in Eqs. 2 through 5.

assumptions (3)

domain assumption CyVaR can be represented as the product of scenario probability and financial loss (Eq. 2).
This definition is asserted without connecting it to the quantile-based VaR in Eq. 1 or to any loss distribution. It is an expected value, not a tail risk measure.
domain assumption Risks across IoT layers and scenarios are additive (Eq. 5).
The total is computed as a simple sum over scenarios and layers, which ignores correlations, conditional dependencies, and overlapping attack paths.
domain assumption Probabilities P_ij and losses L_ij are knowable or estimable.
The paper provides no elicitation method, data source, or calibration procedure, yet the entire output depends on these inputs.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Cyber Value At Risk Model for IoT Ecosystems." pith.science (2026). https://pith.science/paper/RFVQQ3TW

@misc{pith2026250417054,
  author       = {Pith},
  title        = {Pith review of: Cyber Value At Risk Model for IoT Ecosystems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RFVQQ3TW}},
  note         = {Machine review of arXiv:2504.17054}
}

read the original abstract

The Internet of Things (IoT) presents unique cybersecurity challenges due to its interconnected nature and diverse application domains. This paper explores the application of Cyber Value-at-Risk (Cy-VaR) models to assess and mitigate cybersecurity risks in IoT environments. Cy-VaR, rooted in Value at Risk principles, provides a framework to quantify the potential financial impacts of cybersecurity incidents. Initially developed to evaluate overall risk exposure across scenarios, our approach extends Cy-VaR to consider specific IoT layers: perception, network, and application. Each layer encompasses distinct functionalities and vulnerabilities, from sensor data acquisition (perception layer) to secure data transmission (network layer) and application-specific services (application layer). By calculating Cy- VaR for each layer and scenario, organizations can prioritize security investments effectively. This paper discusses methodologies and models, including scenario-based Cy-VaR and layer-specific risk assessments, emphasizing their application in enhancing IoT cybersecurity resilience.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

14 extracted references · 14 canonical work pages

[1]

Public law 116-207. iot cybersecurity i mprovement act of 2020,

U.S. Congress, “Public law 116-207. iot cybersecurity i mprovement act of 2020,” 2020. Accessed: 2024-06-30

work page 2020
[2]

A critical analy sis on the security concerns of internet of things (iot),

F. Muhammad, W. Anjum, and K. S. Mazhar, “A critical analy sis on the security concerns of internet of things (iot),” International Journal of Computer Applications , vol. 111, no. 7, pp. 1–6, 2015

work page 2015
[3]

Demystifying iot security: An exhaustive survey o n iot vulnerabilities and a ﬁrst empirical look on internet-scale iot exploitatio ns,

N. Neshenko, E. Bou-Harb, J. Crichigno, G. Kaddoum, and N . Ghani, “Demystifying iot security: An exhaustive survey o n iot vulnerabilities and a ﬁrst empirical look on internet-scale iot exploitatio ns,” IEEE Communications Surveys & Tutorials , vol. 21, pp. 2702–2733, Thirdquarter 2019. 6

work page 2019
[4]

Inte rnet of things (iot): A vision, architectural elements, and future directions,

J. Gubbi, R. Buyya, S. Marusic, and M. Palaniswami, “Inte rnet of things (iot): A vision, architectural elements, and future directions,” Future Generation Computer Systems , vol. 29, pp. 1645–1660, Sept 2013

work page 2013
[5]

IoT eleme nts, layered architectures and security issues: A comprehe nsive survey,

M. Burhan, R. A. Rehman, B. Khan, and B.-S. Kim, “IoT eleme nts, layered architectures and security issues: A comprehe nsive survey,” Sensors (Basel) , vol. 18, p. 2796, Aug. 2018

work page 2018
[6]

Improved layered architecture for interne t of things,

D. Darwish, “Improved layered architecture for interne t of things,” Int. J. Comput. Acad. Res.(IJCAR) , vol. 4, no. 4, pp. 214–223, 2015

work page 2015
[7]

Internet of things: Architec tures, protocols, and applications,

P . Sethi and S. R. Sarangi, “Internet of things: Architec tures, protocols, and applications,” Journal of Electrical and Computer Engineering , vol. 2017, no. 1, p. 9324035, 2017

work page 2017
[8]

Congressional record volume 166, number 157 (monday, s eptember 14, 2020),

“Congressional record volume 166, number 157 (monday, s eptember 14, 2020),” 2020. Accessed: 2024-06-29

work page 2020

Show all 14 references

[9]

Economic security metrics,

R. B¨ ohme and T. Nowey, “Economic security metrics,” Dependability metrics: Advanced lectures , pp. 176–187, 2008

2008
[10]

The economics of informatio n security investment,

L. A. Gordon and M. P . Loeb, “The economics of informatio n security investment,” ACM Transactions on Information and System Security (TISSEC), vol. 5, no. 4, pp. 438–457, 2002

2002
[11]

Framework for calculating return on security investmen t (rosi) for security-oriented organizations,

T. Y aqoob, A. Arshad, H. Abbas, M. F. Amjad, and N. Shafqa t, “Framework for calculating return on security investmen t (rosi) for security-oriented organizations,” Future Generation Computer Systems , vol. 95, pp. 754–763, 2019

2019
[12]

Cyber risk quantiﬁcation: Investigating the role of cyber value at risk,

A. Orlando, “Cyber risk quantiﬁcation: Investigating the role of cyber value at risk,” Risks, vol. 9, no. 10, 2021

2021
[13]

The beneﬁts and limits of cyber value-at-ri sk,

Deloitte, “The beneﬁts and limits of cyber value-at-ri sk,” 2015. Accessed: 2024-06-30

2015
[14]

A. J. McNeil, R. Frey, and P . Embrechts, Quantitative risk management: concepts, techniques and to ols-revised edition. Princeton university press, 2015. 7

2015

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

Public law 116-207. iot cybersecurity i mprovement act of 2020,

U.S. Congress, “Public law 116-207. iot cybersecurity i mprovement act of 2020,” 2020. Accessed: 2024-06-30

work page 2020

[2] [2]

A critical analy sis on the security concerns of internet of things (iot),

F. Muhammad, W. Anjum, and K. S. Mazhar, “A critical analy sis on the security concerns of internet of things (iot),” International Journal of Computer Applications , vol. 111, no. 7, pp. 1–6, 2015

work page 2015

[3] [3]

Demystifying iot security: An exhaustive survey o n iot vulnerabilities and a ﬁrst empirical look on internet-scale iot exploitatio ns,

N. Neshenko, E. Bou-Harb, J. Crichigno, G. Kaddoum, and N . Ghani, “Demystifying iot security: An exhaustive survey o n iot vulnerabilities and a ﬁrst empirical look on internet-scale iot exploitatio ns,” IEEE Communications Surveys & Tutorials , vol. 21, pp. 2702–2733, Thirdquarter 2019. 6

work page 2019

[4] [4]

Inte rnet of things (iot): A vision, architectural elements, and future directions,

J. Gubbi, R. Buyya, S. Marusic, and M. Palaniswami, “Inte rnet of things (iot): A vision, architectural elements, and future directions,” Future Generation Computer Systems , vol. 29, pp. 1645–1660, Sept 2013

work page 2013

[5] [5]

IoT eleme nts, layered architectures and security issues: A comprehe nsive survey,

M. Burhan, R. A. Rehman, B. Khan, and B.-S. Kim, “IoT eleme nts, layered architectures and security issues: A comprehe nsive survey,” Sensors (Basel) , vol. 18, p. 2796, Aug. 2018

work page 2018

[6] [6]

Improved layered architecture for interne t of things,

D. Darwish, “Improved layered architecture for interne t of things,” Int. J. Comput. Acad. Res.(IJCAR) , vol. 4, no. 4, pp. 214–223, 2015

work page 2015

[7] [7]

Internet of things: Architec tures, protocols, and applications,

P . Sethi and S. R. Sarangi, “Internet of things: Architec tures, protocols, and applications,” Journal of Electrical and Computer Engineering , vol. 2017, no. 1, p. 9324035, 2017

work page 2017

[8] [8]

Congressional record volume 166, number 157 (monday, s eptember 14, 2020),

“Congressional record volume 166, number 157 (monday, s eptember 14, 2020),” 2020. Accessed: 2024-06-29

work page 2020