Will Outsourcing IT Security Lead to a Higher Social Level of Security?

Abstract

More firms outsource information technology (IT) security activities each year, as they determine that they can achieve cost savings or a higher level of security at the same cost. However, despite the estimated benefits, many firms still fail to see a clear positive net benefit from their (private) perspective, given the risks and costs involved. This paper investigates the positive externalities associated with IT security outsourcing. My research suggests that, when one organization decides to outsource its security, both direct and indirect benefits can accrue to other organizations and users. In this paper I analyze how a variety of decision characteristics affect whether and to what level such positive externalities will result. I also discuss implications for public policy and for firm-level decision making.