Neco 2025 Data Processing Question 4

An organisation identifies three security threats with the following probabilities and monetary impacts per year: - Malware infection: probability \(0.02\), impact \(\text{₦}5{,}000{,}000\). - Insider data theft: probability \(0.005\), impact \(\text{₦}12{,}000{,}000\). - Phishing attack: initial probability \(p_{0}=0.04\), impact \(\text{₦}3{,}000{,}000\). The organisation can invest in employee‑training programmes that halve the phishing probability for each \(\text{₦}500{,}000\) spent, up to a maximum reduction of \(80\%\) (i.e., the probability cannot be reduced below \(0.2p_{0}\)). With a training budget of \(\text{₦}1{,}500{,}000\), determine: (a) The final phishing probability after the training. (b) The expected annual loss (sum of probability × impact for all three threats) after the training. (c) Whether the expected loss is below the acceptable risk threshold of \(\text{₦}200{,}000\).