An Agent-Based Model of Insurance and Protection Decisions on IT Systems

This paper discusses the key role of incentives in information systems security. Vulnerabilities can be reduced, and even removed, if individual motivations are taken into account in the process of protection and insurance design. The article first discusses the importance of externalities, free-riding behavior, uncertainty and the incentives mismatch between individuals and organizations involved in information systems security. Previous works perform this study using a game theoretical approach but the paper shows that an agent-based model is capable of including the heterogeneity and interrelations among individuals, not focusing on the reached equilibrium but on the dynamics prior to its emergence.