Portfolio optimization of cyber controls in public utilities
Gagan Tiwarigagan.tiwari@niu.edu.inDepartment of Computer Sciences & EngineeringNoida International UniversityGreater Noida, Uttar Pradesh, 201312, IndiaView full profile → , Chandrashekhar Ramesh Ramtirthkarchandrashekhar.ramtirthkar@vit.eduDepartment of Mechanical EngineeringVishwakarma Institute of TechnologyPune, Maharashtra, 411037, IndiaView full profile → , *B. GayathriCorresponding authorgayathrib@maher.ac.inDepartment of Computer ScienceMeenakshi College of Arts and ScienceMeenakshi Academy of Higher Education & ResearchChennai, Tamil Nadu, 600087, IndiaView full profile → , S. Surendharsurendhar1673@vardhaman.orgDepartment of Computer Science and EngineeringVardhaman College of EngineeringShamshabad, Hyderabad, Telangana, 501218, IndiaView full profile → , P. Varalakshmipvaralakshmi@outlook.comDepartment of Electrical & Electronics EngineeringPragati Engineering CollegeKakinada, Andhra Pradesh, 533437, IndiaView full profile → , Pradnya S. Moonpradnyasmoon@gmail.comDepartment of Computer Science and Business SystemsSt. Vincent Pallotti College of Engineering & TechnologyNagpur, Maharashtra, 441108, IndiaView full profile →
* Corresponding author · click or hover a name for details
- Received:
- 01 Mar 2026
- Published Online:
- 31 Oct 2026
- Article type:
- Research Article
- Language:
- EN
- Article no.:
- JIOS-2492
- Pages:
- 3657–3667
Abstract
Public utilities have to operate under strict budgets, reliability requirements and regulatory requirements, and are simultaneously hit with a growing threat of cyber-attacks. The study suggests a multi-objective cyber-control portfolio optimization framework to choose the cost-effective safeguards for critical infrastructure in the utility sector. It combines the criticality of the asset, the likelihood of a threat to occur, the severity of a vulnerability, the cost of controls, the effectiveness of the risk reduction provided by controls, and the contribution to resilience in a cost-constrained optimization model. A hybrid approach to selecting risks by the Pareto principle and a risk-scoring strategy optimizes security enhancement, operational continuity and investment efficiency. Optimized portfolio is shown to attain 38.6% reduction in residual cyber risk, 24.3% in become more resilient, and 17.8% in control expenditure as compared with conventional priority-based selection via scenario-based evaluation. A framework gives the utility managers a clear, scalable and evidence-based decision support mechanism system.
Keywords
Subject Classifications
References
References
[1] M. Nawlo, F. Alkaraan, and H. R. Katalo, “Portfolio optimisation in the digital economy: A Treynor–Black approach,” J. Risk Financ. Manag., vol. 19, no. 8, Art. no. 563 (2026), doi: 10.3390/jrfm19080563.
[2] G. Kavallieratos, G. Spathoulas, and S. Katsikas, “Cyber risk propagation and optimal selection of cybersecurity controls for complex cyberphysical systems,” Sensors, vol. 21, no. 5, Art. no. 1691 (2021), doi: 10.3390/s21051691.
[3] O. A. Tobar-Rosero, I. F. Gomez-Pedraza, J. E. Candelo-Becerra, J. D. Grajales-Bustamante, and F. E. Hoyos, “Cybersecurity risk mitigation in digital substations based on a control model for communication systems: An experimental validation,” Automation, vol. 7, no. 3, Art. no. 68 (2026), doi: 10.3390/automation7030068.
[4] O. Moncayo Carreño, C. Zambrano-Vega, B. Oviedo, and B. Briones Gavilanez, “Designing an ICT-based digital transformation roadmap for administrative process optimization in a municipal public utility,” Systems, vol. 14, no. 3, Art. no. 270 (2026), doi: 10.3390/systems14030270.
[5] Y. Almansoori, Z. Alkhaja, M. Alkhaldi, and F. Mohamed, “Project portfolio management in public service provision: The case of Bahrain government,” Systems, vol. 14, no. 4, Art. no. 370 (2026), doi: 10.3390/systems14040370.
[6] M. A. Truyols-Pont, A. Bilbao-Terol, and M. Arenas-Parra, “Machine learning for sustainable portfolio optimization applied to a water market,” Mathematics, vol. 12, no. 24, Art. no. 3975 (2024), doi: 10.3390/math12243975.
[7] Z. Afzal, M. Ekstedt, N. Müller, and P. Mukherjee, “Security challenges in energy flexibility markets: A threat modelling-based cyber-security analysis,” Electronics, vol. 13, no. 22, Art. no. 4522 (2024), doi: 10.3390/electronics13224522.
[8] A. Mazzoccoli, “Optimal cyber security investment in a mixed risk management framework: Examining the role of cyber insurance and expenditure analysis,” Risks, vol. 11, no. 9, Art. no. 154 (2023), doi: 10.3390/risks11090154.
[9] M. J. Fari, S. D. Mohsen, and M. F. Abduljabbar, “A study of spectral attributes of Browder-type operators defined using the generalized Browder theorem based on specific linear operators,” J. Interdiscip. Math., vol. 29, no. 5-A, pp. 1133–1143 (2026), doi: 10.47974/JIM-2293.
[10] S. Saeed, H. Gull, M. M. Aldossary, A. F. Altamimi, M. S. Alshahrani, M. Saqib, S. Zafar Iqbal, and A. M. Almuhaideb, “Digital transformation in energy sector: Cybersecurity challenges and implications,” Information, vol. 15, no. 12, Art. no. 764 (2024), doi: 10.3390/info15120764.
[11] M. Diéguez, C. Cares, C. Cachero, and J. Hochstetter, “MASISCo—Methodological approach for the selection of information security controls,” Appl. Sci., vol. 13, no. 2, Art. no. 1094 (2023), doi: 10.3390/app13021094.
[12] Ł. Grodzki, M. Slysz, and G. Waligóra, “Solving the portfolio optimization problem on a photonic quantum computer,” Entropy, vol. 28, no. 7, Art. no. 717 (2026), doi: 10.3390/e28070717.
[13] A. Yonar, “Switching regression analysis for data with outlier using ANFIS trained by GA and PSO,” J. Inf. Optim. Sci., vol. 47, no. 2, pp. 487–506 (2025), doi: 10.47974/JIOS-1571.
[14] B. Li, X. Jin, T. Ba, T. Pan, E. Wang, and G. Gu, “Deceptive cyber-resilience in PV grids: Digital twin-assisted optimization against cyber-physical attacks,” Energies, vol. 18, no. 12, Art. no. 3145 (2025), doi: 10.3390/en18123145.
