How Customer Demand Reactions Impact Technology Innovation and Security

Innovation is a topic of great interest, and most of the discussion in the literature focuses on how an organization can increase their level of product or service innovation. This paper is not about what enables an organization to be more innovative than others, or how organizations can enhance their level of innovation. Rather, this paper uses a game-theoretic economic model to examine market forces related to security risks potentially leading to security breaches inherent in product innovation. This paper establishes our understanding of the impact of differing customer demand reactions to security breaches on feature innovation. We show that conditions under security breaches can either increase or decrease product demand and levels of product innovation in the market. The economic models presented in this paper can help firms better target innovation investments in the presence of ever-increasing security risks. Additionally, this paper establishes a baseline understanding of the influence of market risks on innovation for governmental policy makers tasked with overseeing security risks, including those around intentional or unintentional privacy breaches, without negatively impacting industry innovation.

Innovation is seen as a way to create value [10, 16]. Currently, embedding advanced technology features in products is seen as an important way to innovate. For example, Ostrovsky and Schwarz [23] imagine a future that relies on real-time decision making in an automated sensor network to track vehicle positioning and flow which, when coupled with self-driving cars, offer a real way to reduce traffic congestion. However, such an integrated system also means that every vehicle, and presumably every driver, would be completely track-able. This scenario could open the door for attackers to disrupt traffic systems and lead to injuries and even loss of life. In a less alarming, yet no less concerning scenario, individual vehicles and occupants could be tracked without permission, leading to potential privacy violations. Innovation in products, through the increase in product software features, increases the complexity of the system. This complexity creates room for unintentional errors and software defects, potentially creating software vulnerabilities in such systems. These vulnerabilities represent a portion of potential security risks for these products, along with more traditional security risks, such as malware. When attackers successfully exploit these vulnerabilities, security breaches are the result, which could result in data loss or other harm. Many countries, and most US states, have data breach notification laws, which require companies to notify victims of data breaches. These notification laws require firms to assume the expense of both recovering from the attack as well as notifying affected stakeholders. Companies might be also subject to lawsuits and other regulatory action. Regulation such as the European Union’s General Data Protection Regulation (GDPR) has taken the approach of punishing companies that are victims of attack with heavy fines [19]. This “stick” type of regulation can reasonably be expected to further dampen service and product innovation.

Innovative change is characterized as a process of movement through three overlapping stages, which includes more than just the innovation itself: invention, the innovation itself, and diffusion [4, 18]. Within this framework, an invention is some artifact or idea that could have economic value, whereas innovation is the process by which inventions become usable. The last stage, diffusion, is the spread of capacity to use or take advantage of an innovation. Hamel [10] posits that innovation is a driver of organizational competitiveness. Indeed, innovation through technology is often viewed as a primary mechanism for newcomers to succeed despite their resource disadvantage, but innovation with technology can also be a way for incumbents to renew their success.

The more complex the project or service, the more difficult innovation becomes. Sharma et al. [26] demonstrate that supply chain innovation exhibits a diminishing return, which is consistent with the idea that the more complex something is, the less marginal impact each additional innovation will have on desired outcomes. Modularizing product design is one method that has been used to manage the impact of product complexity on innovation [27]. In terms of technology adoption in general, complexity, or perceived complexity, has long been viewed as an inhibitory factor [11, 28, 34, 35]. However, software complexity is also known to exacerbate security issues [1]. The adoption of IS security measures involves both the firm that develops the innovation and the customer who must assimilate that innovation into their activities, where higher information system (IS) security complexity inhibits adoption [9]. Nelson and Madnick [21] find that strong cybersecurity creates a natural tension with the value derived from innovation and excessive risk required to obtain the innovation.

Is there evidence in the literature that consumers change demand behaviour as the result of a cyber security breach? Wang et al. [30] find that users seek out information security-related knowledge when cyber-attacks occur, and they point out that people react similarly to both physical and cyber attacks. A logical extension is to ask whether users might act on this information and change purchasing behavior. Jeong et al. [13] perform an event study that provides evidence for the assertion that information security breaches do in fact affect the stock price in information technology (IT) intensive industries where a very strong competition effect was found. We assert that stock price changes should reflect investor expectations of consumer demand changes. Zafar et al. [33] found that breaches affect the financial performance of other firms that were not breached, indicating that market externalities exist when IS security breaches occur. Wang et al. [31] show that IT security investments made prior to a security breach dampen the negative stock price impact of the breach. They also showed that when the specific breach was anticipated by the attacked firm, as shown by the 10K disclosures, the stock market reaction was minimal. Thus, we find strong evidence in the literature of a relationship between IS security investments and stock prices, which imply a consumer reaction to security breaches.

Combining these concepts, we assert a relationship between innovation, product features, and vulnerabilities. That is, innovation is manifested as additional features which increase complexity. The increased complexity then leads to opportunity for security breaches as noted above. Figure 1 illustrates the innovation-security breach cycle, where an innovation is turned into product or service features which create security vulnerabilities. These vulnerabilities are exploited and the result is a security breach which impacts consumer demand.

An illustrative example of the innovation-security trade-off can be seen in the mobile phone platform ecosystems, such as Google Play and the Apple App Store. These systems are based on distinct mobile phone operating systems: Android and iOS, respectively. For the Android open operating systems platform, smartphone manufacturers and resellers may modify or extend the system to add functionality. Wu et al. [32] analyzed this common practice of vendors tailoring the Android operating system to their smartphone handsets; such modifications come at a security cost in that an average of about 86% of all preloaded apps are over-privileged. An over-privileged app over-shares with third parties, thereby violating consumer privacy expectations [24]. Foerderer [7] investigated the impact of interfirm interchange among Apple developers on complementary innovation. In addition, the majority of the vulnerabilities found (65–85%) stemmed from vendor customization, and it was found that newer smartphone models are not necessarily more secure than older models [32].

Using data from the National Vulnerability Database [22], we verify that the relative rate of vulnerability discovery is higher for Android than iOS (Figure 2). Figure 2 summarizes the vulnerabilities discovered in the 12 months ending April 30, 2017 based on the National Vulnerability Database [22]. The number of Apps in the figure are as of September 30, 2017. Unsurprisingly, we see that there are more apps available for Android devices, and thus more functionality and implicit innovation. A higher relative rate of vulnerability discovery for the system with more features (i.e., Android) would imply that the excess vulnerabilities in Android could be the result of additional interaction complexities between additional features. Our observations regarding Android versus iOS are not proof of the existence of the innovation-security tradeoff, but rather provide only circumstantial evidence.

The above observations, combined with the reality of finite development time, mean firms face important trade-offs regarding feature development, testing, and security [3, 5]. Since features offer a salient value proposition while security does not, there is an unsurprising tendency to rush products to market before they are fully tested and secured. Even when software firms offer regular updates and patching, their customers often have a difficult task of keeping systems updated in a timely manner [12]. Additionally, we could think of time-to-market relative to a competitor as yet another feature of innovation, at least in terms of how customers react to early availability. Shorter time-to-market would be expected to increase the number of vulnerabilities.

One way of creating innovation with technology is to add features to a technology product, website, or other artifact. Using the vehicle example from above, a unique innovation contributing to Tesla’s success is their ability to upload “over-the-air software” with post-production innovations such as self-driving features and range expansion to older vehicles [6]. This innovation has increased the longevity and performance of Tesla’s older model electric cars. Lyytinen and Rose [17] shows that technology-enabled innovation can be related to the product, service, organization and market. With the advances in platform technologies [2], rapid diffusion has been made possible, further increasing the rate of innovation at every level. Artificial intelligence tools and big data have enabled innovative insurance products where insurers can more accurately categorize risk, pricing products more appropriately, but also introducing concerns regarding security, and therefore privacy, of user data [14]. We make the assumption for the purposes of this research that there is no privacy without security. Integrated autonomous vehicles, geolocation systems, and road sensors have the ability to improve transportation [23] while introducing serious security and privacy implications.

Software vendors have been credibly accused of pushing additional features quickly to customers at the cost of decreased security in their software [25, 29]. Additionally, some features that add functionality do so at the explicit cost of privacy. The discovery of previously undisclosed collection or use of personal data in excess of what the user expects can indeed be construed as a security breach.

This tunnel vision on additional features results in an increased number of vulnerabilities remaining within the source code of the consumer software. As developers have finite time to introduce features and perform testing on those new features, vendors make explicit trade-offs between functionality, ease of use, and security [3, 5]. Websites also experience this explicit innovation-security tradeoff. However, there is evidence of customer push-back when the potential downside is too great. For example, in website contexts for which users have higher privacy concerns, firms reduce their reliance on third-party providers of website functionality; Gopal et al. [8] find lower utilization of third party providers for website functionality when users experience higher privacy concerns. Thus, we observe a need for a firm to balance investments in features, the security of those features, and the customer demand reaction to both.

In this paper, we utilize analytic modeling to examine the Innovation-Security Breach Cycle. The contribution of this paper is to understand how innovation is influenced by user security concerns and adverse events such as security breaches. Under market conditions where user security concerns impact demand, higher levels of innovation observed in more competitive market segments are shown to be impacted by user security concerns manifested through differing customer demand reactions to security breaches as a mechanism that causes more or less innovation. Security concerns are shown to impact the level of innovation in services or products with embedded software technology. In doing so, we recognize differing consumer demand reactions to security violations, and we focus on how these differing reactions may impact the level of innovation in product and service design. An assumption of this paper is the law of unintended consequences [20] as it relates to complex technology-enabled product and service design: more interaction between more features create more opportunities for adverse events related to service and product safety which we consider to be security breaches. Because software technology is often the source of innovative features, we ask “How do firms balance the benefits of innovation versus their unintended consequences?”

We consider the case where additional product features increase demand through greater functionality. The likelihood of a security breach increases with the number of product features as the product features interact in unintended ways, thereby increasing the possibility of unanticipated vulnerabilities. In this market, the demand for a product of firm i is impacted by the number of features and the realized risk of a security breach, such as when customers observe an IT security breach at either firm i itself or at a competing firm. Using a two-stage game, we demonstrate how potential demand changes (from risk or externalities) impact firm strategy. Our experiments illustrate that firms must balance the number of features in their product or service with the potential security risks, given the changes in customer demand when security breaches occur. We consider a symmetric duopoly with two identical profit-maximizing firms, Firm 1 and Firm 2. In the first stage, each firm decides their developer type; low security (L) or high security (H). In the second stage, each firm must decide the level of investment in product features. An increase in features leads to an increase in quantity demanded for a firm’s product; H-type developers incur an additional cost for feature development, \(\alpha \ge 0\) , which affects the expected profit. However, additional features expose the firm to higher risk of a security breach, which in turn decreases demand for the firm’s products. This risk of security breaches is mitigated for H-type developers. We use a standard economic model to establish quantity demanded for each firm under the condition that the entire system is in a ‘good’ state (i.e. there have been no security breaches). The parameters and decision variables are defined in Table 1.

We build our model using the following assumptions.

For simplicity, the decision variable in our model is feature investment, \(z_i\) , \(i=1,2\) .

The decision variable, \(\kappa _i \in \lbrace 0,1\rbrace\) captures this decision where \(\kappa _i=1\) means firm \(i\) has chosen to be a high security developer and \(\kappa _i=0\) means firm \(i\) has chosen to be a low security developer. The set of joint firm developer types is \(\Gamma =\lbrace LL, HL, LH, HH\rbrace\) . The decision to be a high-security developer impacts the cost of feature development by some amount, \(\alpha \ge 0\) . Thus, the cost of feature development is \((1+\alpha \kappa _i)z_i\) . The joint firm developer types are tabulated in Figure 3.

Note that a firm returns to a “good” state when consumers “forget” the earlier security breach. We model this duration as a random variable, as explained in Assumption 5 below.

As in Kolfal et al. [15], we consider \(\Lambda\) to be the base arrival rate of successful attacks for the system (or industry), although not all attacks are successful. A successful attack is one that results in a publicly known security breach that affects consumer demand. We use the terms ‘successful attack’ and ‘security breach’ interchangeably.

Increasing product features also increases the opportunity for an attack to be successful. Let \(\lambda _i= (1+z_i)\Lambda\) for firm \(i=1,2\) be the arrival rate of successful attacks (i.e. security breaches). When a firm experiences a successful attack, the effects will last for a random length of time. Event duration follows an exponential distribution with expected length \(1/\mu _i\) for \(i=1,2\) . While it is possible for firms to affect the expected duration of an event, we do not model this decision. See Figure 4 for an illustration of the state diagram showing the joint firm states that create the steady state probabilities.

We are now able to calculate the steady state probabilities for our model as:where \(\rho _i =\Lambda /\mu _i\) , \(i=1,2\) . The parameter \(\rho _i\) can be thought of as a composite firm-industry risk measure, for firm \(i\) .

As noted in the Introduction section, Jeong et al. [13] demonstrate that information security breaches impact the stock price of organizations in information technology (IT) intensive industries where there is strong competition. We assert that stock price changes should reflect investor expectations related to changes in consumer demand.

Zafar et al. [33] showed that breaches impact the financial performance of other firms that remain unbreached, indicating that market externalities exist when IS security breaches occur. For a negative externality ( \(e_{i}\lt 0\) ) some customers will switch from the affected firm to the unbreached competitor and we call this case “Substitutes in Loss” (or “substitutes” for short). Conversely, for a positive externality ( \(e_{i}\gt 0\) ) some of the unbreached competitor’s customers will also leave the market and we label this case “Complements in Loss” (or “complements” for short). We note that Assumptions 6 and 7 mirror the modeling approach in Kolfal et al. [15].

For tractibility, firms are assumed to be symmetric in all parameters. Thus, we drop the subscript \(i\) for direct-risk ( \(r\) ), externality ( \(e\) ), composite firm-industry risk measure ( \(\rho\) ), expected duration of a security breach ( \(1/\mu\) ), and per-unit profit ( \(\pi\) ). Thus we can model the demand equations for the set of joint firm states \(S\) as:where \(q_i, i=1,2\) is given by (1).

Firms’ per unit profit excluding new feature investment, \(\pi\) , is known and fixed. Consequently, a firm’s marginal profit is taken as \(\pi -(1+\alpha \kappa _i)z_{i}\) , which must be positive ( \(\pi -(1+\alpha \kappa _i)z_{i}\gt 0\) ) as a participation constraint. The profit for firm \(i\) when firms are in joint state \(s\) (with probability \(P_{s}\) ) is \(D_{i,s}(\pi -(1+\alpha \kappa _i)z_{i})\) . Firms maximize their expected profit, which is derived for firm \(i\) as:

To find optimal feature investment, we must examine the first order conditions for the expected profit. We begin by setting \(\frac{\partial E[\Pi _i]}{\partial z_i}=0\) in (7):where \(i,j\in {1,2}\) , \(i\ne j\) andThe solution to (7) contains three roots for each firm, although only one root provides feasible investment choices in the real domain. Based on numerical calculations, we next present a series of observations.

In this paper, we propose a model to evaluate the trade-off between innovation and the risk that is inherently brought on by that innovation. Innovation may cause unanticipated risk for the customer, such as the potential for security breaches caused by unforeseen exposures created through the product ecosystem. The change in demand from the externalities that a firm faces has a substantial impact on the level of innovation that they offer to the customer. This causes a firm to offer either more or fewer innovations than in an environment with no externalities. Different innovation levels are driven by how customers react to the risk imposed on them by the product ecosystem.

We have explored conditions where firms make trade-offs between offering additional features to an IT-related product or service and the marginal decrease in security. The game theoretic economic model presented in this paper illustrates that investment in feature development and subsequent profits are substantially impacted by the demand changes due to externalities for adverse events such as security breaches. The impact of externalities for the product are divided into two distinct categories. The first is complements-in-loss, whereby adverse events experienced by customers at a competing firm decrease the firm’s demand. It is shown that innovation and profits are reduced when the direction of demand reaction to a security breach at one firm is synchronized across firms. In contrast, when demand reaction to a security breach at one firm inversely impacts the other firm, then innovation through additional features (and profits) are higher.

Efforts to control the risk associated with the product ecosystem, such as Apple’s tight control over their app store or a website’s exclusion of third-party functionality providers, will result in lower industry risk. The model illustrates that as the industry risk is reduced from high levels, the equilibrium level of innovation will decrease. Thus, tightly controlled product ecosystems such as Apple’s are expected to dampen innovation somewhat, but this negative impact on demand and profits could easily be offset if the firm is able to desynchronize risks vis-a-vis its competitors while reducing the risks for its customers. In contrast, the Android app store has fewer controls over app developers. The equilibrium level of innovation is higher when the industry risk is higher, as are the realized security breaches arising from the product ecosystem. The stronger control exerted by Apple over their platform environment, seems to have some benefits as far as security is concerned, but product ecosystem innovation as measured by the number of apps is also lower. Our model identifies two potential impacts on the level of innovation that can be strategically managed. The first cause is the level and direction of externalities due to security incidents on demand. The second cause is lower industry risk. Our model explains the impacts of both of these forces which alter the level of innovation in the product ecosystem.

There are many factors and variable values that remain somewhat abstract in this paper. The root causes of market conditions where user security concerns impact demand remain largely unspecified. The line of questioning would be “What does or does not causes those conditions?” This paper does not explicitly deal with the root causes of differences in market conditions, as this is outside our scope and is an avenue for future research.

This research has shown that high-security development is disincentivized, and leads to a type of competitive behavior where the opportunity window for high-security development for all firms is small. This, in turn, leads to innovations where high security is not the focus. Thus, the results indicate that industry security standards or governmental policy intervention are likely required to facilitate high-security solutions. Without such intervention, we would expect to observe the situation that we currently witness, which is a world in which high-security innovations are the exception.