An intrusion prevention system (IPS) acts as a new type of information security technology, the configuration and management of which are currently urgent problems; in particular, debate exists regarding the value of these systems. In this paper, we analyse whether a firm realizes a positive or negative value from using an IPS instead of an intrusion detection system (IDS) in a default configuration and an optimal configuration, respectively. Our results suggest: (a) an IPS could hurt the firm when not configured optimally; (b) the optimal configuration of the IPS depends not only on the cost parameters but also on the external environment (quality of the IDS) in which the firm is operating; (c) whether the IDS is optimally configured or not, the firm will make the same decisions between using the IPS instead of the IDS and continuing to use the IDS; and (d) except for the true positive rate of IDS being in a certain region and the blocking cost being sufficiently high, the firm realizes a strictly nonnegative value if the firm configures the IPS optimally.

This study investigates the effect of information sharing and deferral option on a firm’s information security investment strategies by considering strategic interactions between a firm and an attacker. We find that 1) information sharing decreases a firm’s security investment rate. 2) If a deferral decision is possible, the firm will decrease its immediate investment, and avoid non-investment. 3) After information sharing, the probability of a firm’s deferral decision increases for low-benefit information (SL) but decreases for high-benefit information (SH). 4) When information sharing accuracy is low, a firm only defers decisions in a fraction of SL; when information sharing accuracy is high, the firm defers its decisions in all SL and a fraction of SH. 5) Information sharing can improve the effect of deferral decision when accuracy is low but weaken it when accuracy is high. These results contradict the literature, wherein information sharing reduces a firm’s uncertainty on cybersecurity investment and decreases deferment options associated with investment.