Agency Problems and Adversarial Bilevel Optimization under Uncertainty and Cyber Threats

TL;DR

This paper models an agency problem under uncertainty and cyber threats using advanced stochastic control techniques, deriving a solution for optimal incentive schemes and cybersecurity investments.

Contribution

It extends stochastic control methods to a bilevel, adversarial setting with jumps and ambiguity, providing a novel framework for cyber risk management in agency problems.

Findings

Derived a second order BSDE with jumps for the follower's problem.

Reduced the leader's problem to an integro-HJBI equation and proved uniqueness of the viscosity solution.

Numerical simulations demonstrate the effectiveness of the proposed contracting mechanism under cyber threats.

Abstract

We study an agency problem between a leader (the principal) seeking to design an optimal incentive scheme to a follower (the agent) to increase the value of a risky project subjected to accidents and volatility uncertainty. The agency problem is formulated as a max-min bilevel stochastic control problem with accidents and ambiguity. We show that the problem of the follower is reduced to solve a second order BSDE with jumps, reducing the problem of the leader to solve an integro-partial Hamilton-Jacobi-Bellman-Isaacs (HJBI) equation. By extending stochastic Perron's method to our setting, we obtain viscosity sub- and supersolution envelopes for the Principal's integro-HJBI equation. Under an additional comparison principle in a suitable polynomial growth class, these envelopes coincide and the Principal's value is identified with the unique viscosity solution. The holding company seeks to design an optimal incentive scheme to mitigate these losses. In response, the subsidiary selects an optimal cybersecurity investment strategy, modeled through a stochastic epidemiological SIR (Susceptible-Infected-Recovered) framework. The cyber threat landscape is captured through an L-hop risk framework with two primary sources of risk, internal risk propagation via the contagion parameters in the SIR model, and external cyberattacks from a malicious external hacker. The uncertainty and adversarial nature of the hacking lead to consider a robust stochastic control approach that allows for increased volatility and ambiguity induced by cyber incidents. We illustrate our results with numerical simulations showing how the contracting mechanism enhances the quality of a cluster under cyber threats.