A risk-neutral firm believes that the probability of a harmful cyberattack (see the Mini-Case “Risk of a Cyberattack”) is 25%. It expects to make a profit of $200 million if no attack occurs and $120 million if it is attacked. The firm can spend $5 million to increase its electronic defenses, which reduces the probability of a successful cyberattack to 10%. Use a decision tree similar to Figure to assess whether the firm should make this investment.

  

No attack 220 50% No Investment -80 Attack 50% No attack 220 90% Investment -80 Attack 10%