An economic analysis of information security outsourcing with competitive firms

Abstract

Nowadays, firms may outsource information security operation to a managed security service provider (MSSP). Constructing a game‐theoretic model, this paper examines the strategic interaction between a MSSP and a strategic hacker in the presence of two competitive firms. We find that the MSSP's equilibrium benefit increases with the firms' loss due to user inconvenience and competition intensity when they remain high. It shows that technology similarity may benefit or harm the MSSP, dependent on its investment efficiency. Interestingly, we reveal that the hacker's benefit first decreases and then increases with technology similarity when its learning ability remains moderate.