The Gordon-Loeb model concludes that a firm should spend no more than about 37 percent, or 1 divided by e, of the expected loss from a breach on protecting that asset. It is a ceiling for one asset under stated assumptions, not a budget formula, and later work questions the exact fraction.
What the model says
Lawrence Gordon and Martin Loeb published "The Economics of Information Security Investment" in ACM Transactions on Information and System Security in 2002. They model a single information set with a loss if it is breached, a probability of that loss, and a spend that reduces the probability.
Their headline result is that the optimal spend never exceeds about 37 percent of the expected loss. Expected loss here is the vulnerability (probability of breach) multiplied by the loss if it happens.
A worked reading
Say an asset has a one in ten chance of breach this year, and a breach would cost 2 million. Expected loss is 200,000. The model's ceiling would be about 74,000 for protecting that asset. Spending far above that is hard to justify on loss reduction alone.
Those numbers are made up for the arithmetic. Use your own estimates, and expect them to be rough.
Two lessons people miss
First, the biggest vulnerabilities are not always where to spend most. The model suggests that very exposed assets can be so costly to protect that spending a modest fraction is the rational choice, and very robust ones need little. Mid-range exposure is where spend pays best.
Second, the 37 percent figure is not universal. Jan Willemson challenged the 1/e factor, suggesting some breach functions may justify spending at least half of expected loss.
Where it breaks
- It treats one asset in isolation. Real estates have shared dependencies.
- It needs a loss estimate and a probability, and both are guesses.
- It ignores non-financial duties such as legal obligations and customer commitments.
- It ignores that one control can protect many assets.
How to use it without overtrusting it
Use it as a sanity check on proposals. If a request to protect one system costs more than most of its plausible loss, ask why. Then ask whether other reasons, such as a contract or a regulation, justify the spend.
Safeguard's reachability analysis helps with the probability side. Knowing which vulnerable code paths are actually called gives a better basis for the estimate than raw counts. The free scan at gold.safeguard.sh/scan is a way to start.
Click through it at your own pace, or open it full screen.
Quick check
Is 37 percent of my security budget the right spend?
No. The figure applies to expected loss on one asset, not to a company budget, and it is an upper bound.
Who proposed the model?
Lawrence Gordon and Martin Loeb, in a 2002 paper.
Sources
Last reviewed: 19 October 2026.
