Many software developers employ bug bounty programs that award a prize for the detection of bugs in their software. We analyze, in a model with asymmetric information, under which conditions a bug bounty program is beneficial for a software developer. In our model, a bug bounty program allows...

Machine ethics is a key challenge in times when digital systems play an increasing role in people’s lives. At the core of machine ethics is the handling of personal data and the security of machine operations. Yet, privacy and security engineering are a challenge in today’s business world...

Cross-border data flows are the lifeblood of today’s social and economic interactions, but they also raise a range of new challenges, including for privacy and data protection, national security, cybersecurity, digital protectionism and regulatory reach. This has led to a surge in regulation...

Manufacturers customarily provide only a few product variants to address the average needs of users in the major segments of markets they serve. When user needs are highly heterogeneous, this approach leaves many seriously dissatisfied. One solution is to enable users to modify products on their...

By software vendors offering, via the cloud, software as a service (SaaS) versions of traditionally on-premises application software, security risks associated with usage become more diversified which can greatly increase the value associated with the software. In an environment where negative...

The market for security software has witnessed an unprecedented growth in recent years. A closer examination of this market reveals certain idiosyncrasies that are not observed in a traditional market. For example, it is a highly competitive market with over eighty vendors. Yet, the market...

We study how the impact of capabilities for performance is contingent upon the environment. Using a novel dataset of Information Security startups, we study how markets for technology change the relative impact of technology and marketing capabilities on performance. Since internal technical...

Much information security research focuses on policies firms could adopt to reduce or eliminate employees’ violation behavior. However, current information security policies are based on increasingly outmoded models of compliance behavior. This paper proposes a novel behavioral-based mechanism...