So You Think You Are Safe : Implications of Quality Uncertainty in Security Software

The issue of information uncertainty in the context of information security is increasingly important. Many users lack the ability to correctly estimate the true quality of the security software they purchase, as evidenced by some anecdotes and even some academic research. Yet, most of the analytical research assumes otherwise. Hence, we were motivated to incorporate this "false sense of security" behavior into a game-theoretic model and study the implications on welfare parameters. Our model features two segments of consumers, biased signal recipients (BSR) and unbiased signal recipients (USR), and the monopolistic software vendor. USR consumers observe the true quality of the security software, while the BSR ones overestimate. While the proportion of both segments are known to the software vendor, consumers are uncertain about the segment they belong to. We find that, in fact, the level of the uncertainty is not necessarily harmful to society. Furthermore, there exist some circumstances where society and consumers could be better off if the security software did not exist. Interestingly, we also find that the case where consumers know the information structure and weight their expectation accordingly does not always lead to optimal social welfare. These results contrast with the conventional wisdom and are crucially important in developing appropriate policies in this context