Title: Designing User Incentives for Cybersecurity

Main Text: The traditional “patching” approach to managing software vulnerabilities and cybersecurity risk has been less effective than desired. In theory, once a vulnerability is discovered, software patches should be quickly developed and released by producers and then expeditiously applied by users. Successful completion of this process would help to maintain secure systems. However, what has been consistently observed in practice is that this process instead breaks down (1). Of particular concern is the failure of the current approach to adequately address the economic incentives that underlie users’ decisions to patch their systems. We propose a simple adaptation to software producer offerings (“versions”) involving users’ patching rights and argue why this change would make a patching approach more effective.