Eight terms cover most security economics talk: externality, moral hazard, adverse selection, free riding, lock-in, signalling, tragedy of the commons and prisoner's dilemma. Each describes a way incentives and information, not technology, produce insecure outcomes. This page gives one line and one example for each.
1. Externality
A cost or benefit that lands on someone other than the decision maker. Anderson and Moore compare insecure machines on the internet to a coal fire, where the owner does not bear the full cost. Example: a team skips a patch and customers carry the risk.
2. Moral hazard
Behaving less carefully because someone else bears the loss. The classic case is insurance. Example: a firm with broad cover stops testing restores. Deductibles and control requirements push back. See moral hazard in cyber insurance.
3. Adverse selection
When the people most likely to cause a loss are the most eager to buy cover or take a deal. In the evaluation context, Anderson and Moore describe vendors shopping for the evaluator who will give them the easiest ride.
4. Free riding
Enjoying a benefit without paying. When security depends on the sum of everyone's efforts, the burden falls on those with the highest benefit-cost ratio while others free ride, as the same paper puts it. Example: many users of one open source library, few funders. See open source as a commons.
5. Lock-in
Switching costs that keep customers with a vendor. The paper notes dominant platforms may add security in ways that raise lock-in. Example: a proprietary format that makes leaving costly.
6. Signalling
An observable action that reveals hidden quality. It works only if it costs weak senders more. See security certifications as costly signals.
7. Tragedy of the commons
Garrett Hardin's 1968 idea: a shared resource is overused when each user gains the full benefit and the cost is spread. Elinor Ostrom found communities often solve it with their own rules.
8. Prisoner's dilemma
A game where each player does better by defecting, yet both do worse than if both cooperated. Repeated play can sustain cooperation. See the prisoner's dilemma and threat data sharing.
How to use the terms
When a security failure puzzles you, ask which of these is at work. Who pays? Who knows? Who can see what? The answer often points to a fix that is cheaper than another tool.
Quick check
Which term describes a team skipping a patch while customers carry the risk?
Externality, because the cost lands on someone other than the decision maker.
What is the difference between moral hazard and adverse selection?
Moral hazard is changed behavior after a deal. Adverse selection is who chooses to enter the deal in the first place.
Sources
- Anderson and Moore, Information Security Economics and Beyond
- Tragedy of the commons, Wikipedia
- Prisoner's dilemma, Wikipedia
Last reviewed: 19 October 2026.
