#5107. Contracting managed security service: Double moral hazard and risk interdependency

July 2026publication date
Proposal available till 17-05-2025
4 total number of authors per manuscript0 $

The title of the journal is available only for the authors who have already paid for
Journal’s subject area:
Management of Technology and Innovation;
Computer Networks and Communications;
Computer Science Applications;
Marketing;
Places in the authors’ list:
place 1place 2place 3place 4
FreeFreeFreeFree
2350 $1200 $1050 $900 $
Contract №5107.1 Contract №5107.2 Contract №5107.3 Contract №5107.4
1 place - free (for sale)
2 place - free (for sale)
3 place - free (for sale)
4 place - free (for sale)

Abstract:
The problem of double moral hazard seriously affects the efficiency of information security outsourcing. The interdependency risk of information security between managed security service providers (MSSPs) and client firms further complicates the double moral hazard problem. In the loss-based contract, both positive and negative risk interdependencies make outsourcing more inefficient in most instances. We find that this relational contract leads to a greater social welfare with increase of discount factor, and the double moral hazard problem can be solved within the range that the discount factor is high. Furthermore, both positive and negative risk interdependencies can help relational contract to eliminate double moral hazard within a larger discount range. Finally, as some MSSPs’ efforts are considered to be verifiable, we find that by specifying thresholds in a relational contract, the benefits of an MSSPs default can be limited, thereby ensuring that the relational contract achieves social optimal outcomes in more general cases.
Keywords:
Double moral hazard; Interdependency of information security risks; Managed security service; Relational contract

Contacts :
0