A differential game approach to information security investment under hackers’ knowledge dissemination

We investigate how firms invest in information security under Cournot and Bertrand competition, constructing a differential game where over time hackers become knowledgeable by disseminating security knowledge while the firms can inhibit it through security investments. We demonstrate that higher effectiveness of inhibiting knowledge dissemination may not necessarily give a higher investment since it may harm one firm’s market share. Meanwhile, we find Cournot competition usually yields a higher investment than Bertrand competition, implying that the investment is more effective under Cournot competition.