I have data on security incidents of various companies. I am trying to predict the 'time to discovery' using covariates such as 'motive of security incident', 'pattern of security incident', 'company location' and so on. Each company experienced at least one incident so there are multiple lines per company (where each line represents an incident). I ran a GLMM model (normal distribution with identity link function) but I keep getting an error saying that "estimated covariance matrix of the random effects (G matrix) is not positive definite" and "final Hessian matrix is not positive definite although all convergence criteria are satisfied" How can I address these errors?
Sure, but you haven't provided much information about what the distribution looks like. One favorite method if mine, is I will transform num_affected into something else which has a better distribution. Also, since I assume each site has a different size, you add num_not_affected and essentially predict the ratio of affected. You could use GLM with logit link, as mentioned here.
Already an excellent SE answer about this. To summarize quickly, a GLMM gives parameters estimates for individuals, and GEE gives marginally estimated parameters (for the population). So, if you would like to describe average characteristics of the population, I'd elect for GEE. If you'd prefer subject-specific interpretations, go for GLMM. Both are easy enough to fit in modern software, though the definition of your variance structure may have an impact (if events are less correlated over time, you may choose GEE with an "autoregressive working correlation" structure; while if each individual has an unknown effect on the probability for their unit, an individual "random effect" from GLMM may be best).
For more information, I'd read the excellent answer linked above.