Decision Making in Information Security Investments: Impact of System Vulnerability and Investment Timing on Resource-Sharing Platforms

Hui Zhao (), Yong Wu () and Zhijie Jin ()
Additional contact information
Hui Zhao: Donghua University Library, Shanghai 200051, China
Yong Wu: Glorious Sun School of Business and Management, Donghua University, Shanghai 200051, China
Zhijie Jin: Glorious Sun School of Business and Management, Donghua University, Shanghai 200051, China

Decision Analysis, 2025, vol. 22, issue 1, 70-86

Abstract: This study distinguishes enterprises into high- and low-type categories based on enterprise value and cost efficiency, examining their strategic behaviors in three investment timing games: move simultaneously, the high-type enterprise moves first, and the low-type enterprise moves first. By comparing the three games, we find that both types of enterprises would always exert more effort in the sequential game than in the simultaneous game, and the later-move advantage makes both types of enterprises prefer to become the follower in the game. We also find that the enhanced cost efficiency advantage or enterprise value gap possessed by the high-type enterprise would widen the effort gap between the two types of enterprises, and enhance the low-type enterprise’s incentive to be the follower. Moreover, the existence of system vulnerability not only causes both types of enterprises to reduce their security effort that generates free-riding behaviors but also can first discourage and then encourage enterprises from moving in advance. We further propose a liability-based mechanism to tackle the free-riding problem. We reveal an exact optimal liability coefficient, whether in the simultaneous or sequential game and find that the high-type enterprise should undertake more compensation when its dominant position becomes more obvious and the low-type enterprise could therefore undertake decreased liability. Last, we extend the model to multiple enterprises and show that the results are robust.

Keywords: system vulnerability; resource-sharing platforms; investment timing; security decision; liability-based mechanism (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
http://dx.doi.org/10.1287/deca.2024.0190 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:inm:ordeca:v:22:y:2025:i:1:p:70-86

Access Statistics for this article

More articles in Decision Analysis from INFORMS Contact information at EDIRC.
Bibliographic data for series maintained by Chris Asher ().