EXPRESS: Securing Supply Chains: Subsidies, Insurance, and Hybrid Incentives under Costly Verification

The rising frequency of supply-chain disruptions—driven by physical shocks and cyber intrusions—underscores the need for coordinated action between governments and private firms. Firms may underinvest in security because they do not internalize the broader social losses generated by supply-chain disruptions. Public intervention is complicated, however, because firms privately know their baseline network security, choose unobservable preventive effort, and are subject to costly and imperfect verification. We develop a game-theoretic framework to compare three policy approaches: an ex-ante, audit-based subsidy; an ex-post, inspection-based insurance mechanism; and hybrid mechanisms that combine preventive support with contingent protection. Insurance performs better in lower-security environments, where incidents under shirking remain sufficiently likely for claims inspection and denied coverage to provide credible deterrence. Subsidies perform better in moderate-to-high-security environments, where pre-incident verification remains effective even as disruptions become less frequent. In regions where both instruments are feasible, we use an efficiency index—prevention per unit of agency cost—to identify the preferred mechanism. We then analyze two hybrid designs. Under delayed inspection, the government provides an up-front subsidy but conditions coverage on post-incident verification. Under early audit, the government verifies compliance before activating both subsidy and coverage. These hybrids can outperform pure mechanisms when effective verification friction is high or when firms face a large investment-benefit gap. The results provide three policy implications. First, governments should segment firms by baseline network security rather than apply a uniform program. Second, improving verification accuracy can be as important as reducing its direct cost. Third, hybrid mechanisms are most appropriate when their stronger incentives justify the additional administrative and compliance burden of layered verification.