Information sharing and deferral option in cybersecurity investment

This study investigates the effect of information sharing and deferral option on a firm's information security investment strategies by considering strategic interactions between a firm and an attacker. We find that 1) information sharing decreases a firm's security investment rate. 2) If a deferral decision is possible, the firm will decrease its immediate investment, and avoid non-investment. 3) After information sharing, the probability of a firm's deferral decision increases for low-benefit information (S-L) but decreases for high-benefit information (S-H). 4) When information sharing accuracy is low, a firm only defers decisions in a fraction of S-L; when information sharing accuracy is high, the firm defers its decisions in all S-L and a fraction of S-H. 5) Information sharing can improve the effect of deferral decision when accuracy is low but weaken it when accuracy is high. These results contradict the literature, wherein information sharing reduces a firm's uncertainty on cybersecurity investment and decreases deferment options associated with investment.