So You Think You Are Safe: Implications of Quality Uncertainty in Security Software

Abstract

Many users lack the ability to correctly estimate the true quality of the security software they purchase. Yet, most of analytical research assumes otherwise. We were motivated to incorporate this "false sense of security" behavior into a game-theoretic model and study the implications on welfare parameters. Our model features two segments of consumers, biased signal recipients (BSR) and unbiased signal recipients (USR), and a monopolistic software vendor. USR consumers observe the true quality of the security software, while the BSR ones overestimate. While the proportion of both segments are known to the software vendor, consumers are uncertain about the segment they belong to. We find that, in fact, an increase in the amount of bias (i.e., the disparity between the true quality and perceived quality of security software) is not necessarily harmful to society. Furthermore, there exist some circumstances where society and consumers could be better off if the security software did not exist. Interestingly, we also find that the case where consumers know the information structure and weight their expectation accordingly does not always lead to optimal social welfare. These results contrast with the conventional wisdom and are crucially important in developing appropriate policies in this context.

Keywords: Economics of Information Security, Information Uncertainty, Misinformation, Risk Compensation Behavior

JEL Classification: D82