The Influence of Regulations on Innovation in Information Security

We postulate that regulatory compliance pressures that have forced information security out of obscurity and into the corporate boardroom provide economic justification for information security firms to innovate. We aim to establish the link between regulations and innovation through the intermediary of demand for information security products and services. First, we show from the results of a pilot study of US firms that regulations do indeed bolster demand for information security products and services. Next, we use time series methods to further confirm these results and to establish a strong correlation between demand and innovation, proxied by R&D expenses. The results show that demand is highly correlated with innovation (correlation of 0.516) and that it significantly increases around the timing of major information security regulations and standards (t-stat of 2.2 at a 95% confidence level). Motivated by these findings, we argue in favor of regulating the IT industry, which includes the information security sector, not through imposing punitive regimes but rather by providing incentives to IT producers, thus stimulating technological, process, and organizational innovations.