Risk
!
"
# $ %&'()
#
-.
* ! '+,'''#
/
0
!
"
#
$
1
+/
#%
&''& ()* +((
&'',$
#-
#(
(
.
&''&$
/0 &'',$ (
1
(
!
#(
&''/$
#$
1
2
3
#4
&'',$
- 1
&'',$
2
#
2
#5
1
(
/8
4
&''6
9 :&'
<
;
#
2
( &''& 7
&'',$ /
"
$
3
"
2
(
#
=
=
#
(
#
$
1
3
>
#
$
3
$
$
1
=
=
"
1
3
2
6
3
,
?
3
2
0
@
,/1
2
%
A
#B
/CC/ ;
/CC&
/CCD$
=
=
3
#
/CC'$ E
#(
&''/ 5
&''/$
# 2
(
&'', %
&''&$ *
#(
#7
/CCC (
&''&$ >
A
*
&''6 &''?$
#&'''$
4
4
;
#&''&$
3
F
#&''&$
3
B
"
2
#5
2
A
!
2
#/CC6$
2
&'',$ )2
3
#/CC'$
*
>
#
2
$
3
2
#)- $
#/CC?$
3
2
)2
;G
#
;
/CCD$
;
;G
;G
2
#
2
&''/$
#;
< G &''&$ %
2
*
#4
&'',$
G
#)
7
>
/CC&$
#/C@&$
3
-
5
3
3
#)
7
/C@&$
2
3
9
(
1
#5
#
&''6$ !
( &''&$
)/
(
U j (⋅)
U ′j (⋅) > 0
U ′′j (⋅) < 0 !
%
$
#( * $ #
r=−
U ′′
U′
(
B j ( z1 , z2 ,
!
1
, zn )
&
2
>
B 'j ( zi ) < 0
B"j ( zi ) > 0, ∀i, j
πj
Ij
#
$
2
2
6
πj
Ij
π jI j
"
Ij
!
(
zj
2 3
2
)
B j ( z1 , z2 ,... zn )U j W j − L j + 1 − π j I j − z j + 1 − B j ( z1 , z2 ,... zn ) U j (W j − π j I j − z j )
3
π j = Bj
λ
π j = (1 + λ ) B j #
H'
I'
3 /CDD$,
2
#$
# $
1
# $
2
#
( &'', 7
&'', !
%
&'''$ !
# $
# $
3/
#
4 #
!
3/+/5
3
6
2
4
JH'
7
2
'
#$
2 3
K
max B ( z ) U (W − L + [1 − B ( z )] I − z ) + 1 − B ( z ) U (W − B ( z ) I − z )
#/$
z, I
2#
B' ( z ) = −
/$
1
1
L
#&$
I=L
#,$
2
G
2 3
K
max B ( z )U (W − L − z ) + 1 − B ( z ) U (W − z )
#6$
z
B′ ( z ) = −
B ( z ) + (1 − B ( z ) )
U ′ (W − z )
U ′ (W − L − z )
L
(
1
#?$
>−
1
L
1
#?$
#&$
L
3/,/7
&
2M
4
3
;
0
2
/
/
&
8
#
/$
!
/
z1
/
q ⋅ p ( z2 ) ,0 ≤ q ≤ 1
/
/
p ( z1 )
&
2
H'
/ K
B1 ( z1 , z2 ) = p ( z1 ) + 1 − p ( z1 ) qp ( z2 ) = 1 − 1 − p ( z1 ) 1 − qp ( z2 )
/
#0$
1 − p ( z1 ) 1 − qp ( z2 )
&
2
1
0!
/
!
/
/
9
π 1 ( z1 : z2 ) = [1 + λ ] B1 ( z1 , z2 )
#@$
9
)1
@
λ H' !
H'
/
2 3
2
max B1 ( z1 , z2 ) U j (W − L + 1 − π ( z1 : z2 ) I1 − z1 ) + 1 − B1 ( z1 , z2 ) U j (W − π ( z1 : z2 ) I1 − z1 )
#D$
z1 , I1
!
&
2
#
D$
,
2
1
K
p′ ( z ) 1 − qp ( z ) = −
1
#C$
[1 + λ ] L
K
I = L−
λ
#/'$6
r (1 + λ ) 1 − p ( z ) 1 − qp ( z )
p ( z)
!
6
1
2
p′′ ( z ) (1 − qp ( z ) ) − q p′ ( z )
C
1
2
/'
1
2
>0
#//$
#//$
)1
1
C
/'
1
1
#(
.
3/)/
!
&, &''6$
4
6
10
&''6
(
# 1
# 1
C
"$
!"
"" #
$ %
'
* + "
L
&
,$
/'$
?
"
&'
"(
( #
&'
$
&'
)
( #
( * %
,
2M
p ( z ) + 1 − p ( z ) qp ( z ) > p( z )
K
!
?
p ( z1 )
p ( z1 ) (1 − qp ( z2 ) )
!
p ' ( z1 )
p ' ( z1 ) (1 − qp ( z2 ) )
#
$
B
L−
5
λ
r [1 + λ ] 1 − p ( z ) 1 − qp ( z )
1
11
/
L−
λ
r [1 + λ ] 1 − p ( z )
L
?
2M
B
(
1
2
- . &
#$
!
"/% $
(
%
# $
' %
! ' %
! ' +
0
* +
∂z
∂I
$
<0$
≤0,
∂q
∂q
$ )
∂z
∂I
$
>0$
>0,
∂L
∂L
( * %
/ # *
$ )
%
' % , )'
* +
L
( * %
, )'
#
, )'
# $
$ )
$
( * %
* +
%
$
∂z
∂I
$
= 0,
≥ 0,
∂r
∂r
$
'
2M
=
=
!
#!
&#
$
&$
>
3
p ' ( z1 ) (1 − qp ( z2 ) )
0 "
" ( )'
#π$
&'
' +
12
/
# $,
L
@
2M
K
#
$
>
# $
#
# $
&$
2
N
2
%
&# $
K
%
&
3
2
2
λ* = −
p ′ ( z ) 1 + q − 2qp ( z )
{
}
1 − p ( z ) 1 − qp ( z ) L p′′ ( z ) 1 − qp ( z ) − p′ ( z ) qp′ ( z )
13
#/&$
1 . &
# $
L
"/% $
'
D
% %
1
/λ > *
λ −1
* +# $
, )'
% #
%%
$ )
( * %
1
/λ < *
,
λ −1
2M
!
>
0 "
" (- /
L
C
∂π
∂I
>0$ '
<0,
∂λ
∂λ
2M
J
#
$
!
#
J
,$
1
J
"
3/3
J
4
!
"
14
3
#
/$
H'
H'
)
3
2' #
2'
6
/$ (
/
3
K
3
L
-2
$ 32
/'
12 -2 3,
1
2M
+/
4
A
#
2
A
4
#
!
2'$
'$
A
#B
2
N H'$
p′ ( z
*
1
) = − L1
I1* = L
p′ ( z3* ) = −
#
2 N
'O O/$
p′ ( z2* ) = −
1
L [1 + λ ]
r L − I 2* =
1
L 1 − qp ( z
*
3
p′ ( z4* ) = −
)
I 3* = L
[1 + λ ]
λ
1 − p ( z2* )
1
L [1 + λ ] 1 − qp ( z4* )
r L − I 4* =
[1 + λ ]
λ
1 − p ( z4* ) 1 − qp ( z4* )
F
!
!
#
$
15
#
#
$
$
(
#
/$
#
#!
6$
,$K# $
$
#
4
# $
4
p ′ ( z1 )
= [1 + λ ] 1 − qp ( z4 )
p ′ ( z4 )
!
6
&/
(
1
2
.
&/+/8
2 6
G
3
3
K
16
2
,
2
max
z1 , z2 , I1 , I 2
j =1
(
)
B jU 0 j W − L + 1 − π j I j − z j + 1 − B j U1 j (W − π j I j − z j )
2#
//$
p′ ( z ) 1 + q − 2qp ( z ) = −
I = L−
1
#/6$
(1 + λ ) L
λ
5 !"
"" #
$ '
/)
( * % $
//
#/?$
" " 4 ' /)
"" 4 ' /
( * %
'+' '
" '
'+' '
" /% 4' /
2M
(
# 1
K
r (1 + λ ) 1 − p ( z ) 1 − qp ( z )
/%4 '
,
L
G
#/,$
G
# 1
&$
/6$
G
p′ ( z ) 1 + q − 2qp ( z )
p′ ( z ) 1 − qp ( z )
!
G
&/,/
#
$
6
9
1
G
1
&/,/+1
6
!
3
#" 3
3&''& 5
2
>
17
&'', F
&''&$
(
/
&
3
&
# $
B
/
&
/
/
/
&
/
&
/
qp ( z1 ) (1 − p ( z2 ) )
&
&
p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) ) !
&
&#
/
/
2
&
$
/
qp ( z1 ) (1 − p ( z2 ) )U (W − 2 L + 2 I1 − π ( z1 , z2 ) I1 − z1 ) +
p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) ) U (W − L + I1 − π ( z1 , z2 ) I1 − z1 ) +
(1 − p ( z ) )U (W − π ( z , z ) I
1
1
2
1
#/0$
− z1 )
{
π ( z1 , z2 ) = (1 + λ ) 2qp ( z1 ) (1 − p ( z2 ) ) + p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) )
}
!
1
p′ ( z ) + qp′ ( z ) − qp′ ( z ) p ( z ) = −
K = (1 +
K
L
#/@$
)
( * % "*" '+' & '" "( ' & ' &' /% % 7% '
( * % "*"& '" "( '+' '
" % % "*" / )
( * %
/&
* "
&'
2M
%
!
+
p ( z ) − qp ( z ) (1 − p ( z ) )
∂π ( z, z )
I)
[ r( L − I )] > 0
∂z
π ( z, z )
6
"( )
" "(,
L
1
(1 + λ ) L
0
!
, (
#
$
,
/
#!
&
3
,$
/
F
2 3 G
&
3
# PF $
/
18
# FP $
&
/
3
# P PF $
#
P FPF$
G
2 3
#
$
2 3
#
$
7
0
!
,K
;
3
(
1
3
G
G
%
7
#
&''&$
3
2
&/,/,
19
Q
R
3
#!
9
-
(
B
-
&''6$ !
>
(
7
3
(
*
#()* $
(
A
)
9
*
2 #4
&'', 4 "
4
&'',$ !
4
1
()*
3
*
&''6$
#
S
&''6 (
()* # $
# $
3
3
4
piI ( zi )
piN ( zi )
zi #
$
#
B
piI ( z ) < piN ( z )
piI ' ( z ) ≤ piN ' ( z ) 9
6&
20
!
(
(
)
p I ' ( z I * ) 1 − qp I ( z I * ) = −
(
#/D$
1
1
+
( λ) L
#/D$
p I ' ( z ) (1 − qp I ( z ) ) O p N ' ( z ) (1 − qp N ( z ) )
#C$
zI* I zN*
#
;
O
B
*
B
1
O
B
4
%
#C$
#/'$
7
zI* > zN*
&# $
I I* > I N*
2
3
H'
:/
;!
6
2
(
!
2
/K
B1 ( z1 , z2 ,..., zn ) = 1 − 1 − p ( z1 ) 1 − qp ( z2 ) ... 1 − qp ( zn )
21
*>
π ( z1 : z2 ,..., zn ) = [1 + λ ] B1 ( z1 , z2 ,..., zn ) = [1 + λ ] (1 − 1 − p ( z1 ) 1 − qp ( z2 ) ... 1 − qp ( zn )
!
/
2 3
)
K
max B1U j (W − L + [1 − π 1 ] I1 − z1 ) + [1 − B1 ]U j (W − π 1 I1 − z1 )
#&'$
z1 , I1
n −1
p′ ( z ) 1 − qp ( z )
r[L − I ] =
=−
1
[1 + λ ] L
1 − p ( z ) 1 − qp ( z )
6.
#&&$
n −1
"/% $
!
(
%
* +
/,
$ )
' % )'
! '
L
#&/$
λ
[1 + λ ]
%
( * %
//%
%
* +
∂z
∂I
$
<0$
≤0,
∂q
∂q
$ )
' % $ )'
( * %
"*" (
∂z
∂I
<0$
≤0,
$
∂n
∂n
2M
(
0
1
#/C$
/
&
&
!
1
&
&
%/
3
22
*
"/%
!
7
2
2
,
/
*
A
R(
&
S > Q
9
* Q
&'',
,
;
)
;
-
F
&''6
>
- QA
; G R8
"
(9
"
K
2
" /: %
23
)
%
9
//, /CCD
R(
F
6, @@
9
%
K
6
?
2
(
*
)
7
9
9
(
(
(
%
%
&''&K/0
;
0 7
K
*
B CD /@ /C /CCC
(
%
(
Q*
K
++
@ (
+
A
( Q%
> (
+ / #'
C (
>
*
) ' "+(
*
> A
7
/' !0?$ F
// (
> A
/, (
! "
( F
F
;( % >
*
+
&6, &6D
K (
/ B ,
&''6
-
#- $
)
' &''? !
$ @
()*
+; + /
&'''
7
7
7 Q
Q9
*
&'',
A
*
/? (
&''6
" @
/%
)
A
>
;( % -
+
*
!
6@ B @ . &''6
D@ C&
7 *
# $
#(
G
(
<.=>?;9
/' (
0 %%
/6 (
R
>
/%
4
/,/ /6D
/& ()*
R
+&'',+/C'+7
;.
D (
"
% &''&
%
!
A
K*
,(
R
7
E
>
F
KA
/
& &''/
R. /0 &'',
/0 (
+
/@ :
%
4
5
/D - 1
&''6
/C -
>
) Q
%
)
7
- Q
A
/CC&
R
+
A ;
(A ) ' "+(; "
)' - - :
@ +
)
TU
;;% &''&
R.
/ 6@
&+' /,C@/&/0//' ''
A B
+@ + ";
.
(=* * & ! :7
*C
20. Ehrlich, I., and G. S. Becker, Market Insurance, Self-Insurance, and Self-Protection Journal of
Political Economy, Vol. 80,No. 4,1972, pg. 623-648.
&/ !
K
++
3
V
!
&& 4 "
%
&, 4
) 4
- 7 * 4
(
A
+
&6 4
;
/%
+
&? &''6
+
&'',
#'
>
+
% A 3
-
;
A%
;( % ;
(F
:
+
+
V
1
/%
%
% %
)
? B 6 B
V V
V
K
;
(
( E
A
VV
.
%
%
7
*
Q(
K
R
!0? )
&''&
24
6,D 6?@
&? 4
;
;
A% Q
)
;( % ;
(
?
/%
&0 4
;
;
R0 %%
&@ >
5 .
',@, @
&D >
Q>
R!0? )
6 B
A
)
&'''
9
(
.
*
<
,& 5
/
=
,0 ;
U
-
< G
&''&
(
>
>
6' %
&''&
"
' F K,D #/CC'$
B
6& *
%
!. 5
B
6,
.(
/CC/
(>
)2
A
R? ;8
60 3
44 Q
0 /CDD
/ /&?
%
K
( &0K&,/ &6C&'',
D
R
%
.( Q
6@? ?'&
*
A+A+/ E
A
K)
%
!
)2
+ 3 +&''&'/'6
+
R0 %
W
+%
*
+
QX *
+ V
;
F
4
6'
&'R
R /%
/CCD
-
;
* K
66/ 60C
B
)
D/
U
&''&
3
D
DC6 CCD
*
/CC6
%
;( % >
%
R;
25
(
%
/ ':
W?
*. Q(
"
(-
%
+
K
*
&
R
K
(
Q)
&?? &@0
-
(
A
>
/
*
" /> #
/@, /D0
. &"
"! '
+
6?
)
A) Q
"
( . /CC&
! . 6 &''&
(
*
)2
F
D@' DD,
* Q&''& ( +!7 (
6/ %
(
E
)
R? ;8
3."
R
7
*
R9
>(
,C " 3
7
&''&
(
=)%''(/
4 Q
,D B
! 7
/CC' R? ;8
"
(-
C0 .
R
* K *
* Q(
B ,D
4 Q
9
,@ A
=
-
A
>
5-
# D@,
R
%
>
B
(
K*
(
=2 =,''3=',=,)=
>
> Q
*
R> ;8D:;
,? ;
A
*
% A
A
&''6 (;* *
,6 5
66
Q
A
) Q
,, 5
(
@' @?
/%
&C
,/ 5
&''/
K *
5
222/
6,D 6?@
A %
Q !
/' !0? 66 C A
&'',
> 7
,'
&''&
'
/
, /CC'
A
# +
.
6@
.
6D F
&''&
> Q
6C
)
"
*
!
3
*
W)
%
A
(
A
R
)
F
K(
)2
6/ B , 6'/ 6/D/CC?
-
WA
%
/CDD
Appendix
Proof 1. Baseline scenario:
Objective based on the expected utility function of the firm is
max B ( z ) U B (W − L + [1 − π ( z )] I − z ) + 1 − B ( z ) U N (W − π ( z ) I − z )
z, I
The first order condition for IT security investment is
∂π ( z )
B′ ( z ) [U B − U N ] − 1 +
I B ( z )U B′ + {1 − B ( z )}U N′ = 0 .
∂z
First order condition for insurance is
B ( z ) [1 − π ( z )]U B′ − π ( z ) 1 − B ( z ) U N′ = 0 .
Since
π ( z ) = B ( z ) , from the latter condition we see that U B′ = U N′
(A1)
(A2)
and I=L. That is, the marginal utilities in both
states are equal. From the first condition,
1
B′( z ) = −
L
Proof 2. IT Security Spending with No Insurance Market
Utility function of the firm is
max B ( z ) U B (W − L − z ) + (1 − B ( z ) ) U N (W − z )
(A3)
z
The first order condition for IT security investment is
B′ ( z ) [U B − U N ] − B ( z )U B′ + (1 − B ( z ) )U N′ = 0
{
}
For W large enough, first order Taylor series approximation gives
U N ≈ U B + U B′ L
{
}
(A4)
− B ′ ( z )U B′ L − B ( z )U B′ + (1 − B ( z ) )U N′ = 0
B′ ( z ) = −
since B ( z ) + (1 − B ( z ) )
B ( z ) + (1 − B ( z ) )
U N′
U B′
L
U N′
< 1 , IT security investment when insurance is available at fair market price is lower
U B′
than IT security investment when there is no insurance market available.
Proof 3. Interdependent case:
Utility function of the firm 1 is
max B1 ( z1, z2 )U B1 (W − L + [1 − π ( z1 : z2 )] I1 − z2 ) + 1 − B ( z1 , z2 ) U N 1 (W − π ( z1 : z2 ) I1 − z2 )
z1 , I1
where B1 ( z1 , z2 ) = 1 − (1 − p ( z1 ) ) (1 − qp ( z2 ) )
The first order condition for IT security investment is
∂B1 ( z1 , z2 )
∂π ( z1 , z2 )
I1 B1 ( z1 , z2 )U B′ 1 + 1 − B1 ( z1 , z2 ) U N′ 1 = 0
(U B1 − U N 1 ) − 1 +
∂z1
∂z1
{
}
First order condition for insurance is
B1 ( z1 , z2 )(1 − π 1 ( z1 , z2 ))U B′ 1 − (1 − B1 ( z1 , z2 ))π 1 ( z1 , z2 )U N′ 1 =0
If =0, then I=L and
∂B1 ( z1 , z2 )
1
= p′( z1 )(1 − qp( z2 )) = −
∂z1
L
26
(A5)
If >0, for W large enough, using first order Taylor series approximation
U N 1 ≈ U B1 + U B′ 1 ( L − I1 ) ; U N′ 1 ≈ U B′ 1 + U B′′1 ( L − I1 )
Substituting in A5, dividing by U′B1 and using first order condition for insurance
U N′ 1 B1 ( z1 , z2 ) (1 − [1 + λ ] B1 ( z1 , z2 ) )
=
U B′ 1
[1 + λ ] (1 − B1 ( z1 , z2 ) )
we get
∂B1 ( z1 , z2 )
−1
=
∂z1
[1 + λ ] L
and assuming the CARA utility function we get from the FOC for insurance
r [ L − I1 ] =
where r = −
λ
[1 + λ ] 1 − p ( z1 ) 1 − qp ( z2 )
U ′′
is a constant and greater than 0. Using identical firms,
U′
1
p′ ( z ) 1 − qp ( z ) = −
[1 + λ ] L
I = L−
(A6)
λ
(A7)
r [1 + λ ] 1 − p ( z ) 1 − qp ( z )
Proof 4: Condition for Unique Equilibrium
From the first order condition of IT security investment (A6),
Π11 ( R1 ( z2 ) , z2 ) = p′ ( z1 ) 1 − qp ( z2 ) +
1
=0
[1 + λ ] L
The slope of reaction function for Firm 1 and 2 is
Π112 ( R1 ( z2 ) , z2 ) p′′ ( z1 ) (1 − qp ( z2 ) )
Π 221 ( R2 ( z1 ) , z1 )
p′ ( z1 ) qp′ ( z2 )
=
R1′ ( z2 ) = − 1
=
; R2′ ( z1 ) = − 2
p′ ( z1 ) qp′( z2 )
Π 22 ( R2 ( z1 ) , z1 ) p ′′ ( z1 )(1 − qp( z2 ) )
Π11 ( R1 ( z2 ) , z2 )
In order for reaction curve to intersect, the slope of
R1 should be higher than the slope of R2 . So
p′′ ( z1 ) (1 − qp ( z2 ) )
p ′ ( z1 ) qp ′( z2 )
cross-multiplying and rearranging
p′′ ( z1 )(1 − qp( z2 ) ) − p ′ ( z1 ) qp ′ ( z2 )
{
p ′ ( z1 ) qp′ ( z2 )
.
p ′′ ( z1 )(1 − qp( z2 ) )
>
}{
p′′ ( z1 )(1 − qp( z2 ) ) + p′ ( z1 ) qp′ ( z2 )
}> 0
Note that the second term in the LHS multiplicand is positive. Hence for an unique equilibrium,
p′′ ( z1 )(1 − qp( z2 ) ) − p′ ( z1 ) qp′ ( z2 ) > 0
Assuming symmetric firms, the condition for unique equilibrium can be written as
p′′ ( z )(1 − qp( z ) ) − q p′ ( z )
2
>0
Proof 5:
Denote the level of IT security investment and insurance coverage taken in independent firm and dependent firms
as
z I and z D respectively and I I and I D .
p′ ( z I ) = −
1
λ
; r L−II =
1
+
λ
L
[ ]
[1 + λ ] 1 − p ( z I )
p′ ( z D ) 1 − qp ( z D ) = −
Dividing A8a and A9a,
(A8(a,b))
1
λ
; r L−ID =
D
[1 + λ ] L
[1 + λ ] 1 − p ( z ) 1 − qp ( z D )
p′ ( z I ) = p ′ ( z D ) 1 − qp ( z D ) ; p′ ( z I ) > p ′ ( z D )
If >0, dividing A8b and A9b,
27
zI > zD
(A9(a,b))
L−II
=
L− ID
z >z
I
Proof 6:
D
1− p (z
I
)
> 1− p (z
D
1 − p ( z D ) 1 − qp ( z D )
1− p (zI )
)
L−II
;
L−I
< 1 or I I > I D (if =0, I I = I D ).
p ( z ) p′ ( z )
∂z
=
< 0 since denominator is less than zero.
∂q p′′ ( z ) 1 − qp ( z ) − p′ ( z ) qp′ ( z )
(i)
λ p ′ ( z ) 1 + q − 2qp ( z )
∂I
=−
2
∂z
[1 + λ ] r 1 − p ( z ) 1 − qp ( z )
λ p′ ( z ) 1 + q − 2qp ( z )
∂I ∂z
=
∂z ∂q [1 + λ ] r 1 − p ( z ) 2 1 − qp ( z )
(ii)
(iii)
2
>0
p ( z ) p′ ( z )
2
{ p′′ ( z ) 1 − qp ( z )
2
[1 + λ ] L2
p′′ ( z ) (1 − qp ( z ) ) − p ′ ( z ) qp′ ( z )
∂z
1
=
>0
2
∂λ [1 + λ ] L p ′′ ( z ) (1 − qp ( z ) ) − p ′ ( z ) qp ′ ( z )
λ p ′ ( z ) 1 + q − 2qp ( z )
∂I ∂I ∂z ∂I
=
+
=−
2
∂λ ∂z ∂λ ∂λ
[1 + λ ] r 1 − p ( z ) 1 − qp ( z )
−
1
1 − p ( z ) 1 − qp ( z ) r [1 + λ ]
2
Denote λ * = −
−
(1 + λ )
}
2
[1 + λ ]2 L { p ′′ ( z ) (1 − qp ( z ) ) − p′ ( z ) qp′ ( z )}
1
1 − p ( z ) 1 − qp ( z ) r [1 + λ ]
2
λ p′ ( z ) 1 + q − 2qp ( z )
{
p ′ ( z ) 1 + q − 2qp ( z )
{
}
1 − p ( z ) 1 − qp ( z ) L p′′ ( z ) 1 − qp ( z ) − p′ ( z ) qp′ ( z )
λ
r (1 + λ ) 1 − p ( z ) 1 − qp ( z )
= L−
}
1 − p ( z ) 1 − qp ( z ) L p ′′ ( z ) 1 − qp ( z ) − p′ ( z ) qp′ ( z )
∂I
1
=
2
∂λ
1 − p ( z ) 1 − qp ( z ) r [1 + λ ]
I = L−
>0
∂B
∂π
∂B ∂z
= (1 + λ )
, B ( z ) = 1 − 1 − qp ( z ) 1 − p ( z ) ,
= p′ ( z ) 1 + q − 2qp ( z ) < 0 and
∂q
∂z ∂q
∂z
∂z
∂π
< 0 from proposition 2 (i): As a result,
>0
∂q
∂q
{
Proof 9:
≤0
∂I
λ
=
≥0
∂r r 2 (1 + λ ) (1 − p ( z ) ) (1 − qp ( z ) )
∂z
=0,
∂r
Proof 8:
=
}
− p′ ( z ) qp′ ( z )
∂z
1
=
>0
∂L [1 + λ ] L2 p ′′ ( z ) (1 − qp ( z ) ) − p ′ ( z ) qp ′ ( z )
λ p ′ ( z ) 1 + q − 2qp ( z )
∂I ∂I ∂z
+
= 1−
2
∂L ∂z ∂L
[1 + λ ] r 1 − p ( z ) 1 − qp ( z )
Proof 7:
D
>0
1
∂I
∂I
λλ *
,
> 0 , else
<0.
− 1 . If λ > *
λ − 1 ∂λ
∂λ
(1 + λ )
λ
r (1 + λ ) [1 − B ( z )]
28
= L−
λ
r (1 + λ − π ( z ) )
−1
∂π ( z )
∂B ∂z
= B ( z ) + (1 + λ )
∂λ
∂z ∂λ
∂I
=−
∂λ
∂
λ
(1 + λ − π ( z ) )
∂λ
=−
∂π ( z )
∂λ
2
(1 − λ − π ( z ) )
1−π (z) + λ
∂π ( z )
∂I
>0,
<0.
∂λ
∂λ
If loading factor increases, insurance coverage will decreases if price of insurance ( (z)) increases as well.
∂B ∂z
−
∂π ( z )
∂π ( z )
∂B ∂z
= B ( z ) + (1 + λ )
> 0 (if λ > ∂z ∂λ − 1 = λ ** ,
> 0 ).
B (z)
∂λ
∂z ∂λ
∂λ
We know that insured amount will greater than premium paid.(i.e. ( 1 − π ( z ) > 0 )As a result, if
Proof 10:
In region 1; p′ ( z1 ) =
p ′ ( z3 ) =
−1
−1
λ
, I1 = L . In region 2; p′ ( z2 ) =
, r ( L − I2 ) =
. In region 3;
L
(1 + λ ) 1 − p ( z2 )
(1 + λ ) L
−1
−1
, I 3 = L . In region 4, p′ ( z4 ) =
,
L (1 − qp ( z3 ) )
L (1 + λ ) (1 − qp ( z4 ) )
r ( L − I4 ) =
(1 + λ )
λ
1 − p ( z4 ) 1 − qp ( z4 )
∂z
> 0 , z4 > z3 .
∂λ
As a result, z2 > z4 , z1 > z3 . For the insurance amount, since z2 > z4 , I1 = I 3 > I 2 > I 4 . Traditional Insurance Market
(q=0 , =0) versus Current cyber insurance market. We will compare IT security investment level in region 4 and in
region 1. For cyber insurance coverage taken L = I1 > I 4 . For the IT security investment,
z1 > z3 , z2 > z4 , z2 > z1 and since
p ′ ( z1 )
= [1 + λ ] 1 − qp ( z4 )
p ′ ( z4 )
.
If [1 + λ ] 1 − qp ( z4 ) = 1 , then z1 = z4 .
If [1 + λ ] 1 − qp ( z4 ) < 1
p′ ( z1 ) > p ′ ( z4 )
z1 > z4
If [1 + λ ] 1 − qp ( z4 ) > 1
p′ ( z1 ) < p ′ ( z4 )
z1 < z4
Proof 11: Joint decision-making solution
Suppose that there are two firms; firm 1 and firm 2. Social planner will maximize the following
B1U B1 (W − L + (1 − π 1 ) I1 − z1 ) + (1 − B1 )U N 1 (W − π 1 I1 − z1 ) + B2U B 2 (W − L + (1 − π 2 ) I 2 − z2 ) + (1 − B2 )U N 2 (W − π 2 I 2 − z2 )
where B1 = 1 − (1 − p ( z1 ) ) (1 − qp ( z2 ) ) , B2 = 1 − (1 − p ( z2 ) ) (1 − qp ( z1 ) ) and π 1 = (1 + λ ) B1
FOC for self protection with respect to
∂B1
(U B1 − U N 1 ) − B1U B′ 1 + (1 − B1 )U N′ 1
∂z1
FOC for insurance is;
z1 ;
1+
∂π 1
∂B
I1 + 2 (U B 2 − U N 2 ) − B2U B′ 2 + (1 − B2 )U N′ 2
∂z1
∂z1
∂π 2
I2 = 0
∂z1
B1 (1 − π 1 )U B′ 1 − (1 − B1 ) π 1U N′ 1 = 0
st
Taylor 1 order approximation yields as before
U N′ 1
∂B1
∂π 1
∂B2
∂z1
( I1 − L ) −
B1 + (1 − B1 )
U B′ 1
1+
∂z1
I1 +
∂z1
( I2 − L)
U′
U B′ 2
U′
− B1 B 2 + (1 − B1 ) N 2
U B′ 1
U B′ 1
U B′ 1
For identical agent, U B1 = U B 2 = U B and U N 1 = U N 2 = U N and since
29
∂π 2
I2 = 0
∂z1
(1 − (1 + λ ) B ) = U N′
(1 − B ) [1 + λ ]
U B′
p′ ( z ) (1 + q − 2qp ( z ) ) = −
The above equation can be written as p′ ( z ) (1 − qp ( z ) ) + M = −
1
1
+
( λ)L
1
; M ′ = p′ ( z ) ( q − qp ( z ) ) ≤ 0
(1 + λ ) L
Comparing with individual firm’s first order condition
∂z
1
p′ ( z ) (1 − qp ( z ) ) + M = −
where M=0 and since
<0.
1
+
λ
L
∂
M
(
)
Proof 12:
Utility of firm 1 will be
qp ( z1 ) (1 − p ( z2 ) )U A (W − 2 L + 2 I1 − π ( z1 , z2 ) I1 − z1 ) +
p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) ) U B (W − L + I1 − π ( z1 , z2 ) I1 − z1 ) + (1 − p ( z1 ) )U C (W − π ( z1 , z2 ) I1 − z1 )
First order condition with respect to z1
qp ′ ( z1 ) (1 − p ( z2 ) )U A + p′ ( z1 ) − qp′ ( z1 ) (1 − p ( z2 ) ) U B − p′ ( z1 )U C
∂π ( z1 , z2 )
I1 ) qp ( z1 ) (1 − p ( z2 ) ) U A′ + p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) ) U B′ + (1 − p( z1 ) )U C′ = 0
∂z1
First order condition with respect to I1
( 2 − π ( z1 , z2 ) ) qp ( z1 ) (1 − p ( z2 ) )U A′ + (1 − π ( z1 , z2 ) ) p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) ) U B′ − (1 − p( z1 ) ) π ( z1 , z2 )U C′ = 0
−(1 +
Following first order Taylor series approximation,
U B ≈ U A + U A′ ( L − I ) , U C ≈ U A + 2U A′ ( L − I ) and U B′ ≈ U A′ + U A′′ ( L − I ) .
From first order condition with respect to I1 and replacing (1 − p( z1 ) )U C′ in first order condition,
p′ ( z1 ) − qp′ ( z1 ) (1 − p ( z2 ) ) U A′ ( L − I ) − p′ ( z1 ) 2U ′A ( L − I )
−(1 +
p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) )
2qp ( z1 ) (1 − p ( z2 ) )
∂π ( z1 , z2 )
I1 )
U A′ +
U B′ = 0
∂z1
π ( z1 , z2 )
π ( z1 , z2 )
Substituting the Taylor approximation, dividing by
p′ ( z ) + qp′ ( z ) − qp′ ( z ) p ( z ) = −
U ′A , and since , and for symmetric firms,
1
+ K , where K =
(1 + λ ) L
The equation above can be written as
For the individual choice of z earlier
(1 +
p ( z ) − qp ( z ) (1 − p ( z ) )
∂π ( z , z )
I)
[ r( L − I )]
∂z
π ( z, z )
p′ ( z ) − qp′ ( z ) p ( z ) − K ′ =
L
−1
[1 + λ ] L
K ' =0.From the previous equation
>0
, where K ' = K − qp′ ( z ) > 0
∂z
1
=
>0
∂K ′ p′′ ( z ) 1 − qp ( z ) − qp′ ( z ) p′ ( z )
As a result IT security investment with liability is greater than without liability. The equation above can be written as
−1
p′ ( z ) 1 + q − 2qp ( z ) − K ′′ =
where K ′′ = K − qp′ ( z ) p ( z ) > 0 .
[1 + λ ] L
For the joint choice of z earlier, K′′ =0. Thus, from the last equation
∂z
1
=
>0
∂K ′′ p′′ ( z ) 1 + q − 2qp ( z ) − 2qp′ ( z ) p′ ( z )
IT security investment level with liability is higher than social optimum level of IT security investment without
liability.
Proof 13: Generalization to Several Interdependent Firms
Proof is omitted due to space limitation. However, proof is available from authors upon request.
30