Threat information sharing looks like a prisoner's dilemma. Each firm gains most when others share and it does not, so the individually safe move is to stay quiet, even though everyone is better off if all share. Repeated, trusted exchange is how groups escape that trap.
The dilemma in one table
In the standard version, two prisoners can stay silent or testify. If both stay silent, each serves one year. If both testify, each serves two. If one testifies and the other stays silent, the testifier goes free and the other serves three. Whatever the other does, testifying is better for you, so both testify and both serve two years, worse than the one year they could have had.
The general form orders the payoffs as temptation, reward for mutual cooperation, punishment for mutual defection and the sucker's payoff.
Mapping it to sharing
Take two companies that each see attacks. If both share indicators and lessons, both defend better. If you share and the other does not, you spend effort and may reveal weaknesses while gaining nothing. If you keep quiet and the other shares, you get free defensive value. So each is tempted to hold back.
The costs of sharing are real: legal exposure, reputational worry, staff time and the chance of tipping off an attacker. Anderson and Moore stress that incentives, not only technology, decide whether shared systems work. This mapping is an analogy to build intuition, not a measured result.
What changes the game
The same Wikipedia account explains that the picture changes when the game repeats with no known end. Future rounds create consequences for defection, so cooperation can be sustained even among self interested players. In Robert Axelrod's tournaments, tit for tat did well: it cooperates first, then copies the opponent's previous move. Axelrod found that successful strategies were nice, retaliating, forgiving and non-envious.
Translated to sharing groups:
- Start by giving. A member who contributes first signals good faith.
- Make contribution visible. Members who only take can be asked to give.
- Forgive honest mistakes. A single lapse should not end the relationship.
- Keep the group stable. Known members, regular meetings and clear rules help repeat play.
Lowering the cost of sharing
You can shrink the temptation by shrinking the cost:
- Share indicators, not internals. Hashes, domains and patterns, without customer data.
- Agree handling rules in advance. A simple traffic light scheme for what may be forwarded.
- Get legal sign off once. Pre-approve categories of information so analysts need not ask each time.
- Use an intermediary. A trusted third party can strip identity.
Where it does not fit
Not every sharing problem is a pure dilemma. Some firms share because it is cheap or because they gain reputation. Some data cannot be shared at all because of law. Use the model to find the friction, not to predict behaviour.
Quick check
Why does repeated play help cooperation?
Because future rounds give consequences for defecting, so staying cooperative can pay when there is no known end to the game.
What is the cheapest thing to share first?
Technical indicators without customer data or internal detail.
Sources
Last reviewed: 19 October 2026.
