Who pays
for the control?

A security improvement can be worth making for everyone affected and still look uneconomic to the person asked to pay. Following the costs and the avoided losses across that boundary changes the decision being evaluated.

Consider a hypothetical software service and its customers. An additional control costs the provider 120 units a year. It reduces the provider's expected annual loss by 40 units and customers' expected annual losses by 100. These are invented figures for a deliberately simple comparison, with the same time horizon and no other effects.

On the provider's own account, the control adds 80 units to expected cost. Across the provider and customers together, it saves 20. The technical action is identical in both calculations. What changes is whose consequences enter the decision.

Locate the decision boundary

My 2011 conference paper with Tanveer A. Zia, Rationally Opting for the Insecure Alternative: Negative Externalities and the Selection of Security Controls, addresses security expenditure through economic assessment. The public publisher abstract frames protection in terms of costs and avoided losses, and asks how to assess costly controls in systems and software.

A separate public GIAC paper under my sole authorship, with the same title and a September 2011 acceptance date, develops the allocation question through producer and consumer costs. Its discussion distinguishes individual incentives from an outcome that is best for the parties collectively. The two publication records should remain distinct; the GIAC text is not evidence that the conference chapter contains every detail of that longer treatment.

For the hypothetical service, the useful first question is therefore who can implement the control, who pays for it and who benefits if it works. A single total conceals those three roles.

Follow the loss beyond the purchaser

Ross Anderson's Why Information Security is Hard — An Economic Perspective gives this problem a wider setting. It explains how security failures can arise when the party able to protect a system does not bear the resulting harm. Its historical discussion of distributed denial-of-service attacks illustrates how a compromised machine can impose losses elsewhere. Better protection of that machine then benefits parties outside its owner's immediate calculation.

This is an economic argument about incentives. It does not provide a present-day estimate for our hypothetical service, and the historical examples are not current legal or configuration advice.

Separate a transfer from a saving

Suppose the customers in the example jointly contribute 90 units towards the control. The provider now pays 30 net and avoids 40 in expected losses, leaving a gain of 10. The customers pay 90 and avoid 100, also leaving a gain of 10. The contribution reallocates the cost; it does not create another 90 units of social benefit. Counting the payment as a benefit on one side without recording it as a cost on the other would manufacture an improvement.

The proposed arrangement is still incomplete. Collecting contributions may be costly. Customers may disagree about their shares. Some may be difficult to identify or unable to verify that the control was installed. If arranging and checking the agreement consumes more than the 20-unit surplus, this particular solution no longer passes the same aggregate test.

Nor does the arithmetic establish a legal duty, a fair allocation or a feasible contract. Those questions require their own evidence and institutional choices. The example isolates a reason that a useful control might remain unfunded.

Measure the change that the arrangement buys

A practical evaluation could compare the existing arrangement with a clearly specified alternative. It would record the cost of implementation and maintenance, the parties exposed to loss, and the evidence used to estimate how the control changes that exposure. Expected losses should use a consistent period, with uncertainty retained rather than hidden behind a precise-looking total.

The assessment would also need to test behaviour. A reimbursement promise could alter a customer's precautions. A provider paid for installing a control might maintain it differently from a provider paid for a verified service outcome. Any such response changes the comparison and would need measurement; none is assumed to have occurred in this example.

Distinguishing resource costs from payments between the parties makes the result auditable. So does retaining costs borne by people who did not sign the agreement. A reduction in the purchaser's bill can coexist with a larger burden elsewhere.

The research question is how to connect the capacity to prevent a loss with the incentive to bear the cost of prevention. Answering it requires technical evidence about the control and an economic account of everyone whose position it changes.