Interdependent risk means your chance of loss depends partly on what others do. The Kunreuther and Heal model says that when one party protects itself, it lowers the risk for others, and that can discourage them from investing. The result is under-investment unless the group coordinates.
The sprinkler example
Anderson and Moore summarize the idea with ordinary examples. One apartment owner installs a sprinkler system, which lowers fire risk for the neighbours and makes them less likely to install their own. Airlines may skip screening luggage transferred from carriers they believe are careful. Parents may choose not to vaccinate their children and rely on herd immunity instead.
In each case the benefit of protection spills over to others, so each party has a reason to wait for someone else to pay. The authors note that several quite different outcomes can be stable, from everyone adopting protection to nobody doing so, depending on how well people coordinate.
What it looks like in software
A company that depends on a widely used library gets safer when the library gets fixed, whoever paid for the fix. Some users will free ride on the work of others. A vendor that scans its code well lowers risk for its customers, who may then feel less need to check their own supply chain.
The authors also describe a related effect from LoJack, a car theft device. Once enough owners in a city installed it, auto theft fell sharply because the stolen car trade became too risky. Protection by a share of the population benefited everyone, including those who did not buy it.
Why it matters for your budget
If your risk depends on a partner, a supplier or an open source project, your own spend has limited reach. You can harden your side and still be hurt by the weakest link in the chain. See fourth party risk.
The reverse also holds. If you do your part and your peers do not, you carry costs they avoid.
What to do
- Map dependencies. List the parties whose failure could hurt you, including software you do not write.
- Put the effort where the spillover is largest. Fix what you share with many others, since that helps you and them.
- Change the contract. Ask suppliers for evidence of controls, notice duties and the right to audit.
- Contribute upstream when it is cheap for you. A fix sent to a shared project lowers everyone's risk, yours included.
- Coordinate where you can. Sector groups, shared advisories and common baselines reduce the free rider problem.
A word of caution
The model is a stylized description, not a forecast. Real firms differ in size, loss and options. Use it to ask whether you are waiting for somebody else to act, and whether they are waiting for you.
Quick check
What is the main prediction of the Kunreuther and Heal idea?
When one party protects itself, others benefit and may invest less, so the group can end up under-protected unless it coordinates.
Does interdependence mean your own spend is wasted?
No. It means your spend has limits, so you should also manage dependencies and suppliers.
Sources
Last reviewed: 19 October 2026.
