Risk

! "
# $ %&'()
* ! '+,'''# # -. /

"

# $

1
+/

#% &''& ()* +((

&'',$

#- &''&$

#( . /0 &'',$ (

( 1

( !

#(

&''/$ #$

2 3

#4 &'',$

# - 1 &'',$

#5 &''6 ( &''& 7 &'',$ /

1
( /8 9 :&' "
4 ; <
# $

2
 3

" 2

# $

= = # $

# $

( 1

>

# $

3
 1

= =

"

3 3

2 ,

6 ? 3

2 0

,/1 2

% A

#B /CC/ ; /CC& /CCD$

= =

# /CC'$ E

#( &''/ 5 &''/$

# 2 /CCC ( &'', %

( &''&$ *

#( A * &''6 &''?$

#7 &''&$ > #&'''$

4 ; #&''&$

4
 3 F #&''&$ 3

"

#5 > &'',$ )2

2 3 ! 2

A #/CC'$ 2 # $

* #/CC6$ 3 2

2 #)- $ #/CC?$ 3 2

)-

2 ;G

# ; /CCD$ ;

;G ;G

2 2

# &''/$

#; < G &''&$ %

#4 &'',$

G #- > /CC&$

) 7 #/C@&$

3 -

5
 3 3

#) 7 /C@&$

1 #5 &''6$ !

# ( &''&$

)/

U j (⋅)

U ′j (⋅) > 0 U ′′j (⋅) < 0 ! #( * $ #

U ′′
% $ r=− !
U′

( 1

B j ( z1 , z2 , , zn )

&

2 > B 'j ( zi ) < 0 B"j ( zi ) > 0, ∀i, j

πj Ij πj

# $

6
 Ij

π jI j "

! Ij zj 2 3 2

( )
B j ( z1 , z2 ,... zn )U j W j − L j + 1 − π j I j − z j + 1 − B j ( z1 , z2 ,... zn ) U j (W j − π j I j − z j )

π j = Bj

λ π j = (1 + λ ) B j # 3 /CDD$,

H' I' 2

#$

# $ 1 # $

2 # ( &'', 7 &'', ! % &'''$ ! #$

# $ # $

3/ # 4 #

3/+/5 6 4

3
2 JH' 2 '

7
 2 3

max B ( z ) U (W − L + [1 − B ( z )] I − z ) + 1 − B ( z ) U (W − B ( z ) I − z ) #/$
z, I

2# /$ 1

1
B' ( z ) = − #&$
L

I=L #,$

G 2 3 K

max B ( z )U (W − L − z ) + 1 − B ( z ) U (W − z ) #6$
z

U ′ (W − z )
B ( z ) + (1 − B ( z ) )
U ′ (W − L − z ) 1
B′ ( z ) = − >− #?$
L L

( 1 #?$ 1 #&$

L & 2M

3/,/7 4

3 ; 0 2

/ & # /$

8
 ! / p ( z1 ) z1 /

/ q ⋅ p ( z2 ) ,0 ≤ q ≤ 1

/ &

H' / K

B1 ( z1 , z2 ) = p ( z1 ) + 1 − p ( z1 ) qp ( z2 ) = 1 − 1 − p ( z1 ) 1 − qp ( z2 ) #0$

/ 1 − p ( z1 ) 1 − qp ( z2 )

&

2 1 0! /

! /

π 1 ( z1 : z2 ) = [1 + λ ] B1 ( z1 , z2 ) #@$

9
)1 @ H' λ H' ! / 2 3 2

max B1 ( z1 , z2 ) U j (W − L + 1 − π ( z1 : z2 ) I1 − z1 ) + 1 − B1 ( z1 , z2 ) U j (W − π ( z1 : z2 ) I1 − z1 ) #D$
z1 , I1

! & 2 # D$ ,

1 K

1
p′ ( z ) 1 − qp ( z ) = − #C$
[1 + λ ] L

λ
I = L− #/'$6
r (1 + λ ) 1 − p ( z ) 1 − qp ( z )

! p ( z) 1 C /'

6 2 1 1 2

p′′ ( z ) (1 − qp ( z ) ) − q p′ ( z )
2
>0 #//$

#//$ )1 C

1 /'

#( &''6

. ! &, &''6$

3/)/ 4

10
( # 1 & ,$

# 1 C /'$

!"
"" # $ % &' ( # $ ) ( * %
"$ ' * + " " "( &' &' ( # ,

L ? 2M

p ( z ) + 1 − p ( z ) qp ( z ) > p( z ) K

! /

p ( z1 )

p ( z1 ) (1 − qp ( z2 ) ) !

p ' ( z1 )

p ' ( z1 ) (1 − qp ( z2 ) )

λ
L−
r [1 + λ ] 1 − p ( z ) 1 − qp ( z )

5
1

11
 λ
L− L ? 2M
r [1 + λ ] 1 − p ( z )

( 1

- . & "/% $
#$ ! ( $ ) ( * % * +
∂z ∂I
% ' % , )' $ <0$ ≤0,
∂q ∂q
# $ ! ' % # $ ) ( * % $ * + $
∂z ∂I
, )' $ >0$ >0,
∂L ∂L
# $ ! ' + / # * $ ) ( * % % $ '
∂z ∂I
* + % ' % , )' $ = 0, ≥ 0,
∂r ∂r
L 0 2M

= #! &$

! &# $ > 3

p ' ( z1 ) (1 − qp ( z2 ) )

0 "
" ( )' #π$ &' ' + / # $,

12
L @ 2M

# $

>

# $

# # $ &$

N 2 % &# $

% &

3 2

p ′ ( z ) 1 + q − 2qp ( z )
λ* = − #/&$
{ }
1 − p ( z ) 1 − qp ( z ) L p′′ ( z ) 1 − qp ( z ) − p′ ( z ) qp′ ( z )

13
 1 . & "/% $ ' % # % % %% $ ) ( * %
1 1
# $ , )' * +# $ /λ > * /λ < * ,
λ −1 λ −1
L D 2M

>

∂π ∂I
0 "
" (- / >0$ ' <0,
∂λ ∂λ

L C 2M

J # $

! J

# ,$ 1

" J

3/3 4

"

14
 3

# /$

H'

H'

) 3 2' 2' # 6 /$ ( /

3 -2 $ 32 1 12 -2 3,

L /' 2M

+/ 4 2 4

A A #
# ! 2'$
'$
A
#B
p′ ( z *
1 ) = − L1 p′ ( z2* ) = −
1
L [1 + λ ]
I1* = L λ
2 N H'$ r L − I 2* =
[1 + λ ] 1 − p ( z2* )
1 1
p′ ( z3* ) = − p′ ( z4* ) = −
L 1 − qp ( z *
3 ) L [1 + λ ] 1 − qp ( z4* )
#
2 N I 3* = L λ
r L − I 4* = F
'O O/$ [1 + λ ] 1 − p ( z4* ) 1 − qp ( z4* )

! # $

# $ # $

15
 (

# /$ # 6$

#! ,$K# $ #

$ 4 # $

p ′ ( z1 )
= [1 + λ ] 1 − qp ( z4 ) ! ,
p ′ ( z4 )

&/

( 1

2 . 3 2

&/+/8 2 6

G 3 K

16
 ( )
2
max B jU 0 j W − L + 1 − π j I j − z j + 1 − B j U1 j (W − π j I j − z j ) #/,$
z1 , z2 , I1 , I 2
j =1

2# //$ G K

1
p′ ( z ) 1 + q − 2qp ( z ) = − #/6$
(1 + λ ) L

λ
I = L− #/?$
r (1 + λ ) 1 − p ( z ) 1 − qp ( z )

5 !"
"" # $ ' " " 4 ' /) ( * % '+' ' " '
/%4 ' /) ( * % $ "" 4 ' / '+' ' " /% 4' /
,

L // 2M

( G # 1 /6$

# 1 &$ G p′ ( z ) 1 + q − 2qp ( z )

p′ ( z ) 1 − qp ( z )

G # $

&/,/ 6 9

&/,/+1 6

3 2

#" 3 3&''& 5 > &'', F &''&$

17
 ( & 3 B

/ & # $ / & &

/ / / &

/ /

& qp ( z1 ) (1 − p ( z2 ) ) & /

& p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) ) ! /

&# & $

/ 2 /

qp ( z1 ) (1 − p ( z2 ) )U (W − 2 L + 2 I1 − π ( z1 , z2 ) I1 − z1 ) +
p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) ) U (W − L + I1 − π ( z1 , z2 ) I1 − z1 ) + #/0$
(1 − p ( z ) )U (W − π ( z , z ) I
1 1 2 1 − z1 )

{
π ( z1 , z2 ) = (1 + λ ) 2qp ( z1 ) (1 − p ( z2 ) ) + p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) ) } !

1 K
p′ ( z ) + qp′ ( z ) − qp′ ( z ) p ( z ) = − + #/@$
(1 + λ ) L L

∂π ( z, z ) p ( z ) − qp ( z ) (1 − p ( z ) )
K = (1 + I) [ r( L − I )] > 0
∂z π ( z, z )

6 ) ( * % "*" '+' & '" "( ' & ' &' /% % 7% ' * "
"( ) ( * % "*"& '" "( '+' ' " % % "*" / ) ( * % &'
" "(,

L /& 2M

% 0 ! , ( # $

! ,

/ & 3 F

#! ,$ 2 3 G

/ & 3 # PF $ # FP $

/ &

18
 3 # P PF $ # P FPF$

G 2 3 # $

2 3 # $ 7

! ,K

( 1 3 G

G %

# &''&$ 3 2

&/,/,

19
 Q R 3 #! &''6$ !

9 - > (

- ( B 7 3

( )

* #()* $ ( A 9

2 #4 &'', 4 " 4 &'',$ ! 4

()*

3 # S &''6 ( (

* &''6$ ()* # $

# $

3 !

4 #

piI ( zi ) piN ( zi )

zi # B

$ piI ( z ) < piN ( z )

piI ' ( z ) ≤ piN ' ( z ) 9

6&

20
 ( )
p I ' ( z I * ) 1 − qp I ( z I * ) = −
1
( λ) L
1 +
#/D$

( #/D$ #C$ p I ' ( z ) (1 − qp I ( z ) ) O p N ' ( z ) (1 − qp N ( z ) )

zI* I zN*

# 4

; B

O B *

1 #C$ #/'$ 7

O B % &# $ zI* > zN* I I* > I N*

H'

:/ ;! 6

2 (

/K

B1 ( z1 , z2 ,..., zn ) = 1 − 1 − p ( z1 ) 1 − qp ( z2 ) ... 1 − qp ( zn )

21
 *>

π ( z1 : z2 ,..., zn ) = [1 + λ ] B1 ( z1 , z2 ,..., zn ) = [1 + λ ] (1 − 1 − p ( z1 ) 1 − qp ( z2 ) ... 1 − qp ( zn ) ) #/C$

! / 2 3 K

max B1U j (W − L + [1 − π 1 ] I1 − z1 ) + [1 − B1 ]U j (W − π 1 I1 − z1 ) #&'$

z1 , I1

n −1 1
p′ ( z ) 1 − qp ( z ) =− #&/$
[1 + λ ] L

λ
r[L − I ] = #&&$
[1 + λ ]
n −1
1 − p ( z ) 1 − qp ( z )

6. "/% $
! ( $ ) ( * % * +
∂z ∂I
% ' % )' $ <0$ ≤0,
∂q ∂q
! ' % //% $ ) ( * % "*" ( * "/%
∂z ∂I
* + % ' % $ )' $ <0$ ≤0,
∂n ∂n
L /, 2M

( 0 / &

1 & !

1 &

&

%/

22
 !

/ * S > Q - F "
R( A 9 &''6
& * Q > K ) % R( 9
&'',
, ; ; - QA 2 9 F % K
) ; G R8 "
(9 " /: % //, /CCD 6, @@

23
6 2 * - K * B CD /@ -
( ) ( 9 /C /CCC
? 7 ( ( % ( % "
9 % ; &''&K/0 ( % % &''&
0 7 Q* A R
K
++ + +&'',+/C'+7
@ ( ;. ( Q% R G + +
D ( > ( > * >
+ / #' /% ) ' "+( ;( % - &''6 &6, &6D
C ( > * ( - K ( -
4 <.=>?;9 " @ ( F
! " / B , &''6
/,/ /6D
/' ( > A 7 * ! )
0 %% /' !0?$ F 6@ B @ . &''6 D@ C&
// ( > A 7 * F - #- $
# $ /% ;( % > ' &''? !
/& ()* #( ) * $ @ +; + / ()*
A &'''
/, ( 7 * ! K* >
7 A &'',
/6 ( 7 Q * A ,( R 7 E F / & &''/
/? ( Q9 KA R. /0 &'',
/0 ( +
/@ - 4 > ) Q ) R.
: % 5 % 7 A /CC& / 6@
/D - 1 - Q R + &+' /,C@/&/0//' '' .
&''6
/C - A ; (A ) ' "+(; " )' - - : A B +@ + "; (=* * & ! :7 *C
@ + ) TU ;;% &''&
20. Ehrlich, I., and G. S. Becker, Market Insurance, Self-Insurance, and Self-Protection Journal of
Political Economy, Vol. 80,No. 4,1972, pg. 623-648.
&/ ! -
K
++ 3 + + + + V VV V V V
V ! &? &''6
&& 4 " ) 4 &'', 1 K
% #' : % /% ; (
&, 4 - 7 * 4 % A 3 % % ( E . 7 Q( K
( A > - A % % * R
+ +
&6 4 ; ; A% ) !0? )
/% ;( % ; (F ? B 6 B &''& 6,D 6?@

24
&? 4 ; ; A% Q ) R!0? )
/% ;( % ; ( ? 6 B &''& 6,D 6?@
&0 4 ; ; A % Q !
R0 %% /' !0? 66 C A &'', @' @?
&@ > 5 . Q> A ) K * A ( R
',@, @ 9 &'''
&D > > 7 5 /% # D@, C0 . &''&
&C ( Q - * K * R

,' . * A K* ( (
222/ < / = > =2 =,''3=',=,)= =)%''(/
,/ 5 ) Q * R 7 E F / &
&''/
,& 5 % A A * Q( * ( * R
&''6 (;* * % B ,D
,, 5 > Q * A )2 ) K
( R> ;8D:;
,6 5 > > 4 Q R9 " /> # D ( &0K&,/ &6C&'',
,? ; - < G 4 Q ) R
B &''&
,0 ; 5- ( >( A) Q K *
U 9 R? ;8 ( . /CC&
" /@, /D0
,@ A > " ( % % A+A+/ E
= > ' F K,D #/CC'$ D@' DD,
,D B ! 7 .( .( Q A
/CC' R? ;8 (-
" /CC/ 6@? ?'&
,C " 3 3." ! - K) % % ! )2
7 . 6 &''& + + + 3 +&''&'/'6
6' % * Q&''& ( +!7 ( ( R0 % ; ( ) D/
&''&
6/ % B ( . &"
"! ' / ': % B U &''&
6& * !. 5 (> A W 4 3
% B )2 W? +% ; 6' D DC6 CCD /CC6
6, * > * QX * F &'R * %
+ + + V
66 - Q) K R /% ;( % > ' / , /CC'
&?? &@0
6? - *. Q( * K % A
- A R? ;8 "(- /CCD 66/ 60C
60 3 44 Q * - R; # + .
0 /CDD / /&?

25
6@ . " 3 A % ( A /CDD
6D F > Q * ! * R )
&''&
6C ) W) - K( )2
% WA F 6/ B , 6'/ 6/D/CC?
Appendix
Proof 1. Baseline scenario:
Objective based on the expected utility function of the firm is
max B ( z ) U B (W − L + [1 − π ( z )] I − z ) + 1 − B ( z ) U N (W − π ( z ) I − z )
z, I
The first order condition for IT security investment is
∂π ( z )
B′ ( z ) [U B − U N ] − 1 + I B ( z )U B′ + {1 − B ( z )}U N′ = 0 . (A1)
∂z
First order condition for insurance is
B ( z ) [1 − π ( z )]U B′ − π ( z ) 1 − B ( z ) U N′ = 0 . (A2)
Since π ( z ) = B ( z ) , from the latter condition we see that U B′ = U N′ and I=L. That is, the marginal utilities in both
states are equal. From the first condition,
1
B′( z ) = − (A3)
L
Proof 2. IT Security Spending with No Insurance Market
Utility function of the firm is
max B ( z ) U B (W − L − z ) + (1 − B ( z ) ) U N (W − z )
z
The first order condition for IT security investment is
{
B′ ( z ) [U B − U N ] − B ( z )U B′ + (1 − B ( z ) )U N′ = 0 }
For W large enough, first order Taylor series approximation gives
U N ≈ U B + U B′ L (A4)
{ }
− B ′ ( z )U B′ L − B ( z )U B′ + (1 − B ( z ) )U N′ = 0
U N′
B ( z ) + (1 − B ( z ) )
U B′
B′ ( z ) = −
L
U N′
since B ( z ) + (1 − B ( z ) ) < 1 , IT security investment when insurance is available at fair market price is lower
U B′
than IT security investment when there is no insurance market available.
Proof 3. Interdependent case:
Utility function of the firm 1 is
max B1 ( z1, z2 )U B1 (W − L + [1 − π ( z1 : z2 )] I1 − z2 ) + 1 − B ( z1 , z2 ) U N 1 (W − π ( z1 : z2 ) I1 − z2 )
z1 , I1

where B1 ( z1 , z2 ) = 1 − (1 − p ( z1 ) ) (1 − qp ( z2 ) )
The first order condition for IT security investment is
∂B1 ( z1 , z2 ) ∂π ( z1 , z2 )
∂z1
(U B1 − U N 1 ) − 1 +
∂z1
{
I1 B1 ( z1 , z2 )U B′ 1 + 1 − B1 ( z1 , z2 ) U N′ 1 = 0 } (A5)

First order condition for insurance is

B1 ( z1 , z2 )(1 − π 1 ( z1 , z2 ))U B′ 1 − (1 − B1 ( z1 , z2 ))π 1 ( z1 , z2 )U N′ 1 =0
∂B1 ( z1 , z2 ) 1
If =0, then I=L and = p′( z1 )(1 − qp( z2 )) = −
∂z1 L

26
If >0, for W large enough, using first order Taylor series approximation
U N 1 ≈ U B1 + U B′ 1 ( L − I1 ) ; U N′ 1 ≈ U B′ 1 + U B′′1 ( L − I1 )
Substituting in A5, dividing by U′B1 and using first order condition for insurance
U N′ 1 B1 ( z1 , z2 ) (1 − [1 + λ ] B1 ( z1 , z2 ) )
=
U B′ 1 [1 + λ ] (1 − B1 ( z1 , z2 ) )
we get
∂B1 ( z1 , z2 ) −1
=
∂z1 [1 + λ ] L
and assuming the CARA utility function we get from the FOC for insurance
λ
r [ L − I1 ] =
[1 + λ ] 1 − p ( z1 ) 1 − qp ( z2 )
U ′′
where r = − is a constant and greater than 0. Using identical firms,
U′
1
p′ ( z ) 1 − qp ( z ) = − (A6)
[1 + λ ] L
λ
I = L− (A7)
r [1 + λ ] 1 − p ( z ) 1 − qp ( z )
Proof 4: Condition for Unique Equilibrium
From the first order condition of IT security investment (A6),
1
Π11 ( R1 ( z2 ) , z2 ) = p′ ( z1 ) 1 − qp ( z2 ) + =0
[1 + λ ] L
The slope of reaction function for Firm 1 and 2 is
Π112 ( R1 ( z2 ) , z2 ) p′′ ( z1 ) (1 − qp ( z2 ) ) Π 221 ( R2 ( z1 ) , z1 ) p′ ( z1 ) qp′ ( z2 )
R1′ ( z2 ) = − 1 = ; R2′ ( z1 ) = − 2 =
Π11 ( R1 ( z2 ) , z2 ) p′ ( z1 ) qp′( z2 ) Π 22 ( R2 ( z1 ) , z1 ) p ′′ ( z1 )(1 − qp( z2 ) )
In order for reaction curve to intersect, the slope of R1 should be higher than the slope of R2 . So
p′′ ( z1 ) (1 − qp ( z2 ) ) p ′ ( z1 ) qp′ ( z2 )
> .
p ′ ( z1 ) qp ′( z2 ) p ′′ ( z1 )(1 − qp( z2 ) )
cross-multiplying and rearranging
{
p′′ ( z1 )(1 − qp( z2 ) ) − p ′ ( z1 ) qp ′ ( z2 ) }{ p′′ ( z1 )(1 − qp( z2 ) ) + p′ ( z1 ) qp′ ( z2 ) }> 0
Note that the second term in the LHS multiplicand is positive. Hence for an unique equilibrium,
p′′ ( z1 )(1 − qp( z2 ) ) − p′ ( z1 ) qp′ ( z2 ) > 0
Assuming symmetric firms, the condition for unique equilibrium can be written as
p′′ ( z )(1 − qp( z ) ) − q p′ ( z )
2
>0
Proof 5:
Denote the level of IT security investment and insurance coverage taken in independent firm and dependent firms
as z I and z D respectively and I I and I D .
1 λ
p′ ( z I ) = − ; r L−II = (A8(a,b))
[ ]
1 + λ L [1 + λ ] 1 − p ( z I )
1 λ
p′ ( z D ) 1 − qp ( z D ) = − ; r L−ID = (A9(a,b))
[1 + λ ] L [1 + λ ] 1 − p ( z ) 1 − qp ( z D )
D

Dividing A8a and A9a,

p′ ( z I ) = p ′ ( z D ) 1 − qp ( z D ) ; p′ ( z I ) > p ′ ( z D ) zI > zD
If >0, dividing A8b and A9b,

27
 L−II 1 − p ( z D ) 1 − qp ( z D )
=
L− ID 1− p (zI )

L−II
z >z
I D
1− p (z I
) > 1− p (z D
) ; < 1 or I I > I D (if =0, I I = I D ).
L−I D

Proof 6:
∂z p ( z ) p′ ( z )
= < 0 since denominator is less than zero.
∂q p′′ ( z ) 1 − qp ( z ) − p′ ( z ) qp′ ( z )

∂I λ p ′ ( z ) 1 + q − 2qp ( z )
(i) =− >0
∂z [1 + λ ] r 1 − p ( z ) 1 − qp ( z )
2 2

∂I ∂z λ p′ ( z ) 1 + q − 2qp ( z ) p ( z ) p′ ( z )
= ≤0
∂z ∂q [1 + λ ] r 1 − p ( z ) 2 1 − qp ( z ) 2
{ p′′ ( z ) 1 − qp ( z ) }
− p′ ( z ) qp′ ( z )
∂z 1
(ii) = >0
∂L [1 + λ ] L2 p ′′ ( z ) (1 − qp ( z ) ) − p ′ ( z ) qp ′ ( z )

∂I ∂I ∂z λ p ′ ( z ) 1 + q − 2qp ( z )
+ = 1− >0
∂L ∂z ∂L [1 + λ ] r 1 − p ( z ) 1 − qp ( z ) [1 + λ ] L2 p′′ ( z ) (1 − qp ( z ) ) − p ′ ( z ) qp′ ( z )
2 2

∂z ∂I λ
(iii) =0, = ≥0
∂r ∂r r 2 (1 + λ ) (1 − p ( z ) ) (1 − qp ( z ) )
Proof 7:
∂π ∂B ∂z ∂B
= (1 + λ ) , B ( z ) = 1 − 1 − qp ( z ) 1 − p ( z ) , = p′ ( z ) 1 + q − 2qp ( z ) < 0 and
∂q ∂z ∂q ∂z
∂z ∂π
< 0 from proposition 2 (i): As a result, >0
∂q ∂q
Proof 8:
∂z 1
= >0
{
∂λ [1 + λ ] L p ′′ ( z ) (1 − qp ( z ) ) − p ′ ( z ) qp ′ ( z )
2
}
∂I ∂I ∂z ∂I λ p ′ ( z ) 1 + q − 2qp ( z )
= + =−
∂λ ∂z ∂λ ∂λ [1 + λ ] r 1 − p ( z ) 1 − qp ( z )
2 2
[1 + λ ]2 L { p ′′ ( z ) (1 − qp ( z ) ) − p′ ( z ) qp′ ( z )}
1
−
1 − p ( z ) 1 − qp ( z ) r [1 + λ ]
2

1 λ p′ ( z ) 1 + q − 2qp ( z )
= − −1
1 − p ( z ) 1 − qp ( z ) r [1 + λ ]
2
(1 + λ ) {
1 − p ( z ) 1 − qp ( z ) L p ′′ ( z ) 1 − qp ( z ) − p′ ( z ) qp′ ( z ) }
p ′ ( z ) 1 + q − 2qp ( z )
Denote λ * = − >0
{
1 − p ( z ) 1 − qp ( z ) L p′′ ( z ) 1 − qp ( z ) − p′ ( z ) qp′ ( z ) }
∂I 1 λλ * 1 ∂I ∂I
= − 1 . If λ > * , > 0 , else <0.
∂λ 1 − p ( z ) 1 − qp ( z ) r [1 + λ ]
2
(1 + λ ) λ − 1 ∂λ ∂λ
Proof 9:
λ λ λ
I = L− = L− = L−
r (1 + λ ) 1 − p ( z ) 1 − qp ( z ) r (1 + λ ) [1 − B ( z )] r (1 + λ − π ( z ) )

28
 ∂π ( z ) ∂B ∂z
= B ( z ) + (1 + λ )
∂λ ∂z ∂λ
λ ∂π ( z )
∂ 1−π (z) + λ
∂I (1 + λ − π ( z ) ) ∂λ
=− =−
∂λ ∂λ (1 − λ − π ( z ) )
2

∂π ( z ) ∂I
We know that insured amount will greater than premium paid.(i.e. ( 1 − π ( z ) > 0 )As a result, if >0, <0.
∂λ ∂λ
If loading factor increases, insurance coverage will decreases if price of insurance ( (z)) increases as well.
∂B ∂z
∂π ( z ) − ∂π ( z )
∂B ∂z
= B ( z ) + (1 + λ ) > 0 (if λ > ∂z ∂λ − 1 = λ ** , > 0 ).
∂λ ∂z ∂λ B (z) ∂λ
Proof 10:
−1 −1 λ
In region 1; p′ ( z1 ) = , I1 = L . In region 2; p′ ( z2 ) = , r ( L − I2 ) = . In region 3;
L (1 + λ ) L (1 + λ ) 1 − p ( z2 )
−1 −1
p ′ ( z3 ) = , I 3 = L . In region 4, p′ ( z4 ) = ,
L (1 − qp ( z3 ) ) L (1 + λ ) (1 − qp ( z4 ) )
λ
r ( L − I4 ) =
(1 + λ ) 1 − p ( z4 ) 1 − qp ( z4 )
∂z
z1 > z3 , z2 > z4 , z2 > z1 and since > 0 , z4 > z3 .
∂λ
As a result, z2 > z4 , z1 > z3 . For the insurance amount, since z2 > z4 , I1 = I 3 > I 2 > I 4 . Traditional Insurance Market
(q=0 , =0) versus Current cyber insurance market. We will compare IT security investment level in region 4 and in
region 1. For cyber insurance coverage taken L = I1 > I 4 . For the IT security investment,
p ′ ( z1 )
= [1 + λ ] 1 − qp ( z4 ) .
p ′ ( z4 )
If [1 + λ ] 1 − qp ( z4 ) = 1 , then z1 = z4 .
If [1 + λ ] 1 − qp ( z4 ) < 1 p′ ( z1 ) > p ′ ( z4 ) z1 > z4
If [1 + λ ] 1 − qp ( z4 ) > 1 p′ ( z1 ) < p ′ ( z4 ) z1 < z4
Proof 11: Joint decision-making solution
Suppose that there are two firms; firm 1 and firm 2. Social planner will maximize the following
B1U B1 (W − L + (1 − π 1 ) I1 − z1 ) + (1 − B1 )U N 1 (W − π 1 I1 − z1 ) + B2U B 2 (W − L + (1 − π 2 ) I 2 − z2 ) + (1 − B2 )U N 2 (W − π 2 I 2 − z2 )
where B1 = 1 − (1 − p ( z1 ) ) (1 − qp ( z2 ) ) , B2 = 1 − (1 − p ( z2 ) ) (1 − qp ( z1 ) ) and π 1 = (1 + λ ) B1
FOC for self protection with respect to z1 ;
∂B1 ∂π 1 ∂B ∂π 2
(U B1 − U N 1 ) − B1U B′ 1 + (1 − B1 )U N′ 1 1+ I1 + 2 (U B 2 − U N 2 ) − B2U B′ 2 + (1 − B2 )U N′ 2 I2 = 0
∂z1 ∂z1 ∂z1 ∂z1
FOC for insurance is;
B1 (1 − π 1 )U B′ 1 − (1 − B1 ) π 1U N′ 1 = 0
st
Taylor 1 order approximation yields as before
∂B1 U N′ 1 ∂π 1 ∂B2 U B′ 2 U′ U′ ∂π 2
( I1 − L ) − B1 + (1 − B1 ) 1+ I1 + ( I2 − L) − B1 B 2 + (1 − B1 ) N 2 I2 = 0
∂z1 U B′ 1 ∂z1 ∂z1 U B′ 1 U B′ 1 U B′ 1 ∂z1

For identical agent, U B1 = U B 2 = U B and U N 1 = U N 2 = U N and since

(1 − (1 + λ ) B ) = U N′
(1 − B ) [1 + λ ] U B′

29
 1
p′ ( z ) (1 + q − 2qp ( z ) ) = −
( λ)L
1 +
1
The above equation can be written as p′ ( z ) (1 − qp ( z ) ) + M = − ; M ′ = p′ ( z ) ( q − qp ( z ) ) ≤ 0
(1 + λ ) L
Comparing with individual firm’s first order condition
1 ∂z
p′ ( z ) (1 − qp ( z ) ) + M = − where M=0 and since <0.
(1 + λ ) L ∂M
Proof 12:
Utility of firm 1 will be
qp ( z1 ) (1 − p ( z2 ) )U A (W − 2 L + 2 I1 − π ( z1 , z2 ) I1 − z1 ) +
p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) ) U B (W − L + I1 − π ( z1 , z2 ) I1 − z1 ) + (1 − p ( z1 ) )U C (W − π ( z1 , z2 ) I1 − z1 )
First order condition with respect to z1
qp ′ ( z1 ) (1 − p ( z2 ) )U A + p′ ( z1 ) − qp′ ( z1 ) (1 − p ( z2 ) ) U B − p′ ( z1 )U C
∂π ( z1 , z2 )
−(1 + I1 ) qp ( z1 ) (1 − p ( z2 ) ) U A′ + p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) ) U B′ + (1 − p( z1 ) )U C′ = 0
∂z1
First order condition with respect to I1
( 2 − π ( z1 , z2 ) ) qp ( z1 ) (1 − p ( z2 ) )U A′ + (1 − π ( z1 , z2 ) ) p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) ) U B′ − (1 − p( z1 ) ) π ( z1 , z2 )U C′ = 0
Following first order Taylor series approximation,
U B ≈ U A + U A′ ( L − I ) , U C ≈ U A + 2U A′ ( L − I ) and U B′ ≈ U A′ + U A′′ ( L − I ) .
From first order condition with respect to I1 and replacing (1 − p( z1 ) )U C′ in first order condition,

p′ ( z1 ) − qp′ ( z1 ) (1 − p ( z2 ) ) U A′ ( L − I ) − p′ ( z1 ) 2U ′A ( L − I )
∂π ( z1 , z2 ) 2qp ( z1 ) (1 − p ( z2 ) ) p ( z1 ) − qp ( z1 ) (1 − p ( z2 ) )
−(1 + I1 ) U A′ + U B′ = 0
∂z1 π ( z1 , z2 ) π ( z1 , z2 )

Substituting the Taylor approximation, dividing by U ′A , and since , and for symmetric firms,
∂π ( z , z ) p ( z ) − qp ( z ) (1 − p ( z ) )
(1 + I) [ r( L − I )]
1 ∂z π ( z, z )
p′ ( z ) + qp′ ( z ) − qp′ ( z ) p ( z ) = − + K , where K = >0
(1 + λ ) L L
−1
The equation above can be written as p′ ( z ) − qp′ ( z ) p ( z ) − K ′ = , where K ' = K − qp′ ( z ) > 0
[1 + λ ] L
∂z 1
For the individual choice of z earlier K ' =0.From the previous equation = >0
∂K ′ p′′ ( z ) 1 − qp ( z ) − qp′ ( z ) p′ ( z )
As a result IT security investment with liability is greater than without liability. The equation above can be written as
−1
p′ ( z ) 1 + q − 2qp ( z ) − K ′′ = where K ′′ = K − qp′ ( z ) p ( z ) > 0 .
[1 + λ ] L
For the joint choice of z earlier, K′′ =0. Thus, from the last equation
∂z 1
= >0
∂K ′′ p′′ ( z ) 1 + q − 2qp ( z ) − 2qp′ ( z ) p′ ( z )
IT security investment level with liability is higher than social optimum level of IT security investment without
liability.
Proof 13: Generalization to Several Interdependent Firms
Proof is omitted due to space limitation. However, proof is available from authors upon request.

30