Information security investment for complementary and substitutable firms: The role of technology similarity.

While technology similarity in network security aggravates breach interdependence, it can improve the efficiency of security information sharing. This paper examines the effect of technology similarity on information security investment with mandatory standards through constructing a game-theoretic model with two firms whose information assets are complementary and substitutable respectively. We show that for strict mandatory standards, while technology similarity first decreases and then increases the cost functions of complementary firms, it always decreases the cost functions of substitutable firms. We find that security information sharing always decreases the cost functions of both complementary and substitutable firms and thus should be encouraged. We reveal that when mandatory standards become much stricter, the cost functions of complementary firms always increase but the cost functions of substitutable firms increase if and only if the substitution degree remains relatively high. Finally, we demonstrate that hacker learning, as a factor to intensify breach interdependence, benefits substitutable firms and harms complementary firms in the case of strict mandatory standards.