Moral hazard situations and misaligned incentives in cybersecurity

Abstract

Security in the cyberspace is not only a technical matter, but it also contains a human element introduced by those who design and operate the systems involved. In this respect, the incentives that befall on those persons cannot be ignored. We understand that a moral hazard arises when the risks generated by one of the parties in a transaction are borne by the other, creating an incentive to act recklessly. In this paper, we analyze three cases in which this situation occurs in a cybersecurity context and in which the incentives of manufacturers or providers of services are misaligned with the ones of users or consumers.