A lemons market forms when sellers know quality and buyers do not. In security, buyers often cannot tell a strong product from a weak one, so price becomes the main signal and good products struggle. Buyers escape by demanding evidence they can test, not claims they must trust.
Akerlof in one paragraph
George Akerlof's 1970 paper described used cars. Sellers know which cars are good and which are defective. Buyers cannot, so they offer an average price. Owners of good cars will not sell at that price, which lowers average quality on offer, which lowers the price, and so on. Akerlof compared it to Gresham's law: the bad drives out the good.
The security version
Anderson and Moore apply this directly. Their example uses 50 good cars worth 2,000 and 50 lemons worth 1,000. At an average price the good cars leave. For security products, when users cannot tell good from bad, they may as well buy the cheaper one, and a race to the bottom follows.
They go further. In some cases the vendor does not know how secure its own software is. Then neither side has the information, and nobody pays a premium for real protection.
Why security is a hard case
- Failures are rare and delayed, so a product can look fine for years.
- Absence of incidents proves little.
- Marketing language sounds the same across good and weak vendors.
- Certifications can be gamed. The same paper describes adverse selection in evaluation schemes, where vendors shop for the easiest evaluator.
How buyers escape it
Buyers need ways to turn hidden quality into visible quality.
- Run it on your own code. A trial on a real repository beats a demo on the vendor's sample.
- Ask for evidence, not adjectives. Request test results, false positive handling and a sample report.
- Check what the claim is based on. A named standard or a dated report is testable. A superlative is not.
- Look for signals that cost something to fake, such as published methods and customer references you can call.
- Compare outcomes. Time to fix and findings you can verify matter more than counts.
What sellers can do
Sellers escape by making quality observable: free scans, published methodology, and honest limits. Safeguard offers a free scan at gold.safeguard.sh/scan so a buyer can judge output on their own project before any commitment.
Quick check
Does a certification fix the lemons problem?
Only if the scheme is hard to game. Anderson and Moore describe schemes where vendors choose lenient evaluators, which weakens the signal.
What is the quickest test of a security product?
Run it on your own code and check whether the findings are real and fixable.
Sources
Last reviewed: 19 October 2026.
