Decision Making in Information Security Investments: Impact of System Vulnerability and Investment Timing on Resource-Sharing Platforms

This study distinguishes enterprises into high- and low-type categories based on enterprise value and cost efficiency, examining their strategic behaviors in three investment timing games: move simultaneously, the high-type enterprise moves first, and the low-type enterprise moves first. By comparing the three games, we find that both types of enterprises would always exert more effort in the sequential game than in the simultaneous game, and the later-move advantage makes both types of enterprises prefer to become the follower in the game. We also find that the enhanced cost efficiency advantage or enterprise value gap possessed by the high-type enterprise would widen the effort gap between the two types of enterprises, and enhance the low-type enterprise’s incentive to be the follower. Moreover, the existence of system vulnerability not only causes both types of enterprises to reduce their security effort that generates free-riding behaviors but also can first discourage and then encourage enterprises from moving in advance. We further propose a liability-based mechanism to tackle the free-riding problem. We reveal an exact optimal liability coefficient, whether in the simultaneous or sequential game and find that the high-type enterprise should undertake more compensation when its dominant position becomes more obvious and the low-type enterprise could therefore undertake decreased liability. Last, we extend the model to multiple enterprises and show that the results are robust.