Cost-Aware Cyber-Threat Mitigation Framework for Critical Infrastructure Environment

Critical infrastructure systems continue to face growing threats against industrial communication protocols and embedded hardware. Despite increasing pressure to improve cybersecurity, operational constraints, limited budgets, and complex environments make it difficult for organizations to prioritize and implement effective mitigation strategies. Traditional risk models rely on static scoring systems, such as CVSS, which fail to capture the evolving nature of threats and the costs of deploying controls. Although some recent models, such as SecScore, address time-dependent risk, they often overlook the economic impact of mitigation efforts. This paper presents SecOptICS, a time-aware, risk-informed, and cost-sensitive cybersecurity investment model for ICS environments. The model accounts for the probability of exploit code development for a vulnerability over time, the frequency of threats, and the financial cost and effectiveness of security controls. SecOptICS introduces a utility-based framework that enables organizations to dynamically assess and prioritize both vulnerabilities and mitigation strategies. Through ICS-specific case studies using CVE data, we demonstrate how SecOptICS supports more strategic resource allocation by quantifying residual risk and identifying the optimal time to deploy controls. Our results show that SecOptICS offers a practical and adaptable approach to cybersecurity decision making in resource-constrained industrial environments.