Attack-Deterring and Damage-Control Investments in Cybersecurity

This paper studies investment in cybersecurity, where both the software vendor and the consumers can invest in security. In addition, the vendor can undertake attack-deterring and damage-control investments. I show that full liability, under which the vendor is liable for all damages, does not achieve efficiency and, in particular, the vendor underinvests in attack deterrence and overinvests in damage control. Instead, the joint use of an optimal standard, which establishes a minimum compliance framework, and partial liability can restore efficiency. This suggests that policies that encourage not only firms, but also consumers to invest in security might be desirable.