Supply chain cybersecurity investments with interdependent risks under different information exchange modes

Cybersecurity presents non-negligible challenges for firm collaboration and supply chain viability, as information exchange among nodes introduces potential interdependent risks. How to make appropriate decisions on security investments and information exchange modes is a significant issue for supply chain members. Considering two information exchange modes: system interconnection and system independence, this study develops two game models to investigate the cybersecurity investments in a vertical supply chain composed of a retailer and n suppliers. Initial analysis shows that although firms learn investment decisions mutually in the face of a changing cybersecurity environment, suppliers always take a free ride on the efforts of retailer in two cases and the increased interdependent risks will damp nodes enthusiasm for security investments. Next, to compare the two cases, we introduce information exchange efficiency as the mediate parameter to link degree of system interconnection and proportion of information shared. We found that under the system independence mode, firms with high information-exchanging demand in the large-scale supply chain are more motivated to invest in cybersecurity. Furthermore, we extend our models to a centralised decision-making scenario. We find that security investment efficiency is greatly improved, and the free-riding behaviour of supplier is significantly reduced when systems are interconnected.