The economic dimensions of cloud security: A systematic literature review

Cloud computing has shifted organizational security spending from predictable capital expenditures to variable, usage-based operational costs, yet academic research continues to treat cloud security and cloud economics as separate domains. This paper presents a SLR of 59 peer-reviewed journal articles (2021–2025), following a three-phase PRISMA-guided methodology, to examine how cloud security threats, controls, and governance practices generate measurable financial commitments and investment requirements. The findings reveal three persistent cost patterns, cost-centric attacks, service disruption and recovery expenditures, and defense overhead from encryption, AI-driven detection, and DevSecOps practices. They show that the financial burden varies across sectors, with banking and healthcare facing the heaviest compliance costs and SMEs operating under strict affordability constraints. A four category cost taxonomy is proposed covering resource efficiency management, investment decision management, cost-as-governance, post-incident cost classification. Persistent gaps include the absence of explicit cost modeling frameworks, insufficient quantification of governance costs under NIS2, DORA, and the Cyber Resilience Act, and a lack of longitudinal empirical evidence.