Hidden information versus hidden action in security contracts

Security deals suffer from two different gaps. Hidden information means one side knows quality and the other does not. Hidden action means one side can behave in ways the other cannot see. They need different fixes: tests for the first, monitoring and incentives for the second.

The split

Anderson and Moore, drawing on Moore's classification, say many security problems fall into one of two types.

Hidden information. The seller knows how good the product is. The buyer does not. Akerlof's market for lemons is the classic case: with 50 good cars worth 2,000 each and 50 lemons worth 1,000, the buyer cannot tell which is which, so the market price drifts toward the lemon price and good cars leave.

Hidden action. The parties want to transact, but one party's unobservable behavior affects the result. Insurance is the classic case, where the insured may act recklessly without the insurer seeing it.

Spotting which one you have

Ask: before the deal, can I see quality? After the deal, can I see behavior?

• If you cannot judge quality up front, you have hidden information. Examples: a security product claim, a vendor's control description.
• If quality is knowable but behavior later is not, you have hidden action. Examples: how a processor handles your data, how a contractor treats credentials.

Fixes for hidden information

1. Test it yourself. Trials on your own data beat demos.
2. Ask for costly signals. See security certifications as costly signals.
3. Use independent evidence. Reports with dated scope.
4. Pay for outcomes where you can measure them.

For more, see the lemons problem in security products.

Fixes for hidden action

The authors say designers can minimise the capacity for hidden action or make it easy to enforce suitable contracts. In practice:

1. Log and review. Access logs, audit rights and change records make behavior visible. See agent audit log fields.
2. Share the loss. Deductibles and retention keep the insured careful. See moral hazard in cyber insurance.
3. Limit what can be done. Least privilege reduces the room for hidden behavior.
4. Use notice duties. Require prompt breach and subprocessor change notices. See vendor breach notification clause.

A worked case: hiring a managed service

Before signing, you face hidden information about the provider's skills. Test with a pilot and reference calls. After signing, you face hidden action: do they follow the runbook at 3 a.m.? Require reports, sampled reviews and a clear right to audit.

Quick check

Sources

• Anderson and Moore, Information Security Economics and Beyond

Last reviewed: 19 October 2026.