Regret Aversion and Market Provision of (Cyber)Security

This paper studies the effect of market structure on cybersecurity under alternative behavioral models of consumer risk preference. I show that consumer regret aversion can reverse the competitive effect on security provision. If consumers are expected utility maximizers, competition between service providers leads to lower security. By contrast, if consumers are regret averse, competition instead leads to higher market-level security. I also characterize the conditions under which the results extend to a general regret function and a general demand system. I conclude with implications for antitrust law and cyber policy. The findings provide a rationale for behavioral interventions in cybersecurity such as ranking-and-shaming programs.