Online Supplement for ISR Manuscript “ Cloud Implications on Software Network Structure and Security Risks ”

Appendix Proof of Lemma 1: We first provide the complete parameter regions and the corresponding consumer equilibrium outcome: (I) Unpatched On-premises only (0 < v u < 1): (A) δ ≤ 1 − c p (i) p ≤ p s (1 − c p)/δ and α ≤ α B ; (ii) p s (1 − c p)/δ < p ≤ p s /δ and α ≤ α A ; (B) δ > 1 − c p (i) p ≤ 1 − c p − δ + p s and α ≤ α B ; (ii) 1 − c p − δ + p s < p ≤ p s and α ≤ α C ; (iii) p s < p ≤ p s /δ and α ≤ α A ; (II) SaaS only (0 < v d < 1): p > 1 + p s − δ and α ≤ α D (III) No Patching On-premises with Unpatched On-premises at the bottom (0 < v u < v d < 1): (A) δ > 1 − c p (a) p s ≤ 1 − c p (i) 1 + p s − δ − c p < p ≤ p s and α C < α ≤ ˆ α 2 ; (b) p s > 1 − c p (i) 1 + p s − δ − c p < p ≤ 1 − c p and α C < α ≤ ˆ α 2 ; (ii) 1 − c p ≤ p ≤ p s and α C < α; (IV) No Patching On-premises with Unpatched On-premises at the top (0 < v d < v u < 1): (A) δ ≤ 1 − c p (a) p s ≤ δ − c p (i) p s (1 − c p)/δ < p ≤ p s /δ and α A < α ≤ ˆ α; (ii) p s /δ < p ≤ 1 + p s − δ and α ≤ ˆ α; (iii) 1 + p s − δ < p ≤ 1 − c p and α D < α ≤ ˆ α; (iv) 1 − c p ≤ p and α D < α; (b) δ − c p < p s ≤ δ(1 − c p)