The HERMENEUT project seeks to improve the understanding of cyber-risks on intangible assets by measuring their depreciation following a cyber-attack. Intangible assets that include brand value, Intellectual property, reputation, consumer trust on firms and firms' collected data represent on average 80% of companies' total assets and may have a high probability of being harmed by cyber-attacks. As a consequence, HERMENEUT first seeks to value intangible assets hold by firms, and then to evaluate the individual (firm level) and societal impacts of cyber-attacks on their intangible assets. In addition, the HERMENEUT project aims to mitigate, assess and manage the associated cyber-risks with the help of the different work packages involved.
By combining innovative economics, risk-mitigation and risk assessment approaches, HERMENEUT is innovative in the sense that it goes a step beyond the state of the art on cybersecurity modelling and impact evaluation. Progresses that are made include the definition of a proactive model of vulnerabilities from WP2, the definition of intangible assets taxonomy and their valuation, together with the definition and application of a generic micro and macro model of evaluation of the effects of cyber-attacks from WP3, the definition of the risk assessment methodology and definition of the Benefit-Harm Index (BHI) from WP4, the analysis of case studies in the healthcare and IP intensive sectors from WP5, and policy recommendations on cyber-risks from WP7. Modelling and analysing the impacts of cyber-attacks on intangible assets at the firm and macro levels represent a major contribution of the HERMENEUT project in particular, and to the cybersecurity field in general.
The results that are expected from the project include the identification of vulnerabilities, the provision of micro and macro estimations of the effects cyber-attacks according to the HERMENEUT defined taxonomy on intangible assets and their overall costs, and the provision of an innovative risk assessment methodology.
Impacts from the HERMENEUT project are thus expected at different levels. First, at the societal level, it is expected to improve the understanding of the cyberspace and its failures by individuals and organizations. Second, it is expected to improve security investments of firms given the importance of cyber-information and its failures. Third, improved resilience towards the cyber-risks within the society is also expected by the means of effective institutions, regulations and incentives. Finally, with the use of (economics) models that are beyond state of the art, HERMENEUT seeks to contribute to the information security field with innovative models aiming at managing, assessing and evaluating the effects of cybersecurity on economic activity.
