Information Security Investment with Different Information Types: A Two-Firm Analysis

We analyze information security investment decisions by two firms that possess imperfectly substitutable information assets. Information assets are imperfectly substitutable if information at each firm is valuable and becomes more valuable when combined. When compared to optimal investment decisions made by a central planner, we find diametrically opposite results in the case where these decisions are made independently: substitutable assets lead to an “arms race” in which both firms over-invest whereas complementary assets lead to under-provision of “public goods” in which both firms under-invest. We also find that firms with highly substitutable information assets may not necessarily increase the amount of security investment in a centralized investment environment as the intensity of the deflected cross traffic increases.