Explainable security investment: A Shapley value inspired metric

Many existing methods can effectively find the optimal cybersecurity investment, but communicating these findings to non-technical stakeholders is a well-known cybersecurity challenge [27]. This work aims to provide additional metrics that grant further insight and justifications for an implemented cybersecurity portfolio. The Shapley value is a classic concept in cooperative game theory that quantifies the fair contribution of each player to a collective outcome. In security games, it offers a natural way to measure the contribution of individual security controls to overall defence. However, the Harsanyi dividend of combining two coalitions when taking their respective security reductions as their portfolio contribution tends to negative attributions in undesirable situations. This undermines interpretability. In this work, we propose a novel measure tailored for security games which guarantees non-negative Harsanyi dividends when combining coalitions that result in the significant increase of security. The method is grounded in the composition of two key factors that capture each control’s marginal impact. These factors offer an interpretable and fair decomposition of the overall security effectiveness. Beyond interpretability, we demonstrate how these attributions can support decision-making in cyber defence planning. To address computational scalability, we present an approximation algorithm that significantly reduces runtimes with little impact on explainability.