Increasing cybersecurity investments in private sector firms

This article by Lawrence A. Gordon, Martin P. Loeb, William Lucyshyn, and Lei Zhou develops an economic framework to assess the effectiveness of government incentives and regulations in increasing cybersecurity investments among private sector firms. It argues that such incentives are necessary due to a systematic underinvestment in cybersecurity, exacerbated by externalities that private firms often overlook. The study analyzes the relationship between cybersecurity inputs and the resultant security levels, suggesting that without government intervention, firms do not invest optimally due to not internalizing the broader social costs of cybersecurity breaches.