Insecure software is a negative externality. The vendor or team that ships a weak component keeps the savings, while customers, downstream users and third parties bear the damage. Economists have named this gap between private cost and social cost as a core reason security keeps failing, and each remedy shifts who pays.
What an externality is
A negative externality is an unpriced cost that a transaction imposes on people who were not part of it. The textbook examples are factory pollution and traffic congestion. The producer's private cost is lower than the total cost to society, so the producer makes more of the harmful thing than it would if it paid the full bill.
How it shows up in security
Anderson and Moore describe a PC owner who connects an insecure machine to the internet. That person does not face the full cost, "any more than someone burning a coal fire." Spam, phishing sites and botnet traffic land on strangers.
Software works the same way. A maintainer or vendor who skips hardening saves time. The cost arrives later, on a customer whose data is stolen or on a user whose device joins an attack on someone else.
The remedies on the table
Economists list four standard tools for externalities. Each has a security version.
- A tax or fee set to the external cost. In security this is rare, but fixed statutory damages for ignoring takedown requests were proposed in a report Anderson and Moore describe.
- Regulation that sets a minimum standard, such as secure defaults.
- Liability, so that the party who causes harm pays for it. The same paper notes that liability should fall on the party best placed to manage the risk.
- Bargaining between affected parties, which works poorly when millions of people are each harmed a little.
What this means for a buyer
You cannot rely on a vendor to price in damage it never pays for. That is why contracts, audit rights, patch commitments and evidence requests matter. They are private ways to move some of the cost back to the party that controls the risk.
It also explains why internal teams behave the same way. A team that ships fast and leaves a weak dependency in place pushes cost onto whoever runs the service at 3 a.m. Charge that cost back, through gates or shared on call, and behavior changes.
Safeguard's policies and gates let a security team put a price on risky changes at the pull request, before the cost lands on someone else. You can also run the free scan at gold.safeguard.sh/scan on a repository to see what you currently carry.
Quick check
Is an externality the same as a market failure?
It is one common cause of market failure. Because the full cost is not priced, the market produces too much of the harmful activity.
Who should bear the cost of insecure software?
Anderson and Moore, drawing on legal theory, say liability should go to the party that can best manage the risk. In practice that is often the vendor, though policy on software liability is still debated.
Sources
Last reviewed: 19 October 2026.
