Managing Interdependent Information Security Risks: Cyberinsurance, Managed Security Services, and Risk Pooling Arrangements

TLDR

Interdependent information security risks lead firms to invest inefficiently, and although cyberinsurance has been proposed to optimize spending, it fails to address the inefficiency caused by risk interdependency. This study examines two alternative risk‑management approaches—risk‑pooling arrangements (RPAs) and managed security services (MSSs)—to mitigate such inefficiencies. The authors analyze how RPAs can complement cyberinsurance to curb overinvestment from negative externalities, while MSS providers can internalize externalities across multiple firms to reduce investment inefficiency. They find that RPAs effectively address overinvestment when security investments generate negative externalities but are not incentive‑compatible when positive externalities exist, whereas MSSs internalize externalities and mitigate inefficiency, yet collective outsourcing only emerges as an equilibrium when the number of firms is small.

Abstract

The interdependency of information security risks often induces firms to invest inefficiently in information technology security management. Cyberinsurance has been proposed as a promising solution to help firms optimize security spending. However, cyberinsurance is ineffective in addressing the investment inefficiency caused by risk interdependency. In this paper, we examine two alternative risk management approaches: risk pooling arrangements (RPAs) and managed security services (MSSs). We show that firms can use an RPA as a complement to cyberinsurance to address the overinvestment issue caused by negative externalities of security investments; however, the adoption of an RPA is not incentive-compatible for firms when the security investments generate positive externalities. We then show that the MSS provider serving multiple firms can internalize the externalities of security investments and mitigate the security investment inefficiency. As a result of risk interdependency, collective outsourcing arises as an equilibrium only when the total number of firms is small.