Income, interdependence, and substitution effects affecting incentives for security investment

Abstract

Firms in cyber war compete with external intruders such as hackers over their assets. Each firm invests in security technology when the required rate of return from security investment exceeds the average attack level, or when the formal control requirements dictate investment. Each firm invests maximally in security when the average attack level is 25% of the firm’s required rate of return. The income effect eliminates or “freezes” parts of the agent’s resource, attack tools, and competence. The security investment decreases in the income reduction parameter when the agent’s resource is low, is inverse U shaped when the resource is intermediate, and drops to zero when the external threat is overwhelming. A sufficiently strong income effect eliminates the external threat. When two firms are interdependent, security investments and attacks impact both firms. With increasing interdependence, each firm free rides by investing less, suffers lower profit, while the agent enjoys higher profit. The substitution effect causes the agent to allocate his attack optimally between the firms. The attack distribution is endogenized. Each firm’s security investment increases in its asset and investment efficiency. The attack against each firm increases in the product of the firm’s asset and investment inefficiency. Specific analyses are made of how the substitution effect impacts security investment for differently sized firms.