The study found that decision makers in information security often make irrational choices when faced with budget decisions involving risk. By framing budget requests in terms of assets protected rather than potential losses, decision makers are more likely to allocate greater budgets. This suggests that decision makers exhibit unique risk attitudes when evaluating gain-related and loss-related risks. The findings recommend that existing models for information security investments should consider risk perception and expected decision biases to make more effective budget decisions.