Malware and market share

Abstract

This article presents a game-theoretic model of the interaction between malware creators (hackers) and users. Users select and hackers target information technology platforms based upon each platform’s network externalities and security. In equilibrium, a platform’s market share among users and the distribution of malware across platforms are derived endogenously. In particular, a platform’s relative market share is shown to be the square root of the ratio of its competitor’s vulnerability to its own vulnerability. This provides a useful standard for guiding a platform’s security strategy and for characterizing platform competition on the basis of security. It is also consistent with the longstanding empirical folk wisdom that platform leaders must make increasing investments into cybersecurity in order to maintain market share.