Market Adoption of Cybersecurity : A Dynamic Analysis

This paper presents a continuous-time dynamic model of market adoption of cybersecurity. Individuals choose whether and when to make a precautionary investment in self-protection against the evolving security risk of direct attack and indirect contagion. The equilibrium adoption path has a ``tipping point'': individual users will invest to get protected all at once when a critical mass of the infected has been reached. Perhaps surprisingly, in the presence of externalities, the market equilibrium path is found to be exactly the socially optimal path. This welfare theorem is robust under several extensions of the model, including heterogeneous valuation, software piracy, weak targets, security upgrade, and ex-post recovery. The findings cast doubt on the government interventions that are justified by externalities in the market for information security