The Sovereign Constraint: Geopolitical Risk, Firm Resilience, and Regulation: Theoretical Foundations

Geopolitical tensions, cyber operations, and supply-chain disruptions have made firms’ resilience to hostile shocks a central concern for economic policy. We develop a unified framework in which firms invest in resilience, a strategic attacker decides whether to strike, and a regulator subsidizes resilience under costly public funds. We analyze static and dynamic environments under symmetric and asymmetric information. In the static benchmark, we characterize the optimal subsidy scheme and show how Myersonian virtual costs distort resilience investment downward and increase attack incentives relative to full information. We then extend the model to repeated interactions in which resilience is a depreciating stock. We derive dynamic virtual costs and characterize stationary first-best and second-best resilience paths, showing that information frictions permanently reduce resilience and raise attack intensity. Three additional extensions examine declining defensive effectiveness, endogenous attack technology, and a forward-looking attacker who strategically erodes resilience over time. These settings generate, respectively, persistent underinvestment as defenses lose effectiveness, an arms race between attackers and defenders, and stationary Markov-perfect equilibria. Across all specifications, asymmetric information and costly public funds systematically reduce resilience investment, with persistent consequences for attack intensity, defensive effectiveness, technological adaptation, and attackers’ strategic incentives.