Information Security Economics: An Investigation of Demand-Driven Innovation and Market Value

The proposed research integrates theories of demand-driven innovation and market value creation to explain (i) the role of demand in driving innovation in information security and (ii) the role of innovation in projecting firm performance thus determining firm market value. Time series and event study analyses are applied to show that malicious attacks, primarily those that exploit software vulnerabilities, create more demand for security firms' products and services, in turn driving additional innovation and generating more demand. It is also shown that innovation by information security firms boosts investors’ confidence. Additional findings, based on a trend analysis and pilot study, suggest that regulations and standards are a key driver of demand for information security products and services. We propose supplementing the latter study with interviews of decision makers at US firms to further understand the drivers of innovation in the information security area.