Information Security Expenditures and Real Options: A Wait-and-See Approach

Abstract

This paper examines the deferment option explanation for why information security breaches are so prevalent. Our examination will focus on security breaches within major U.S. corporations and will include some empirical evidence to support our discussion. As will be seen, the evidence presented supports the argument that the ubiquitous nature of security breaches is due, at least in part, to the wait-and-see (i.e., deferment option) approach of many senior managers. This article will also show why such an approach is quite rational from an economics perspective.