the effects of mitigations in the IT and the cybersecurity investment contexts. We also apply the adapted models to a real …-world cybersecurity investment case from a Japanese company. Investments in multiple cybersecurity mitigations are typically treated as … lower cybersecurity costs without compromising on loss-prevention. More generally, our models allow implementing the real …