Abstract
This study investigates the effect of information sharing and deferral option on a firm's information security investment strategies by considering strategic interactions between a firm and an attacker. We find that 1) information sharing decreases a firm's security investment rate. 2) If a deferral decision is possible, the firm will decrease its immediate investment, and avoid non-investment. 3) After information sharing, the probability of a firm's deferral decision increases for low-benefit information (SL) but decreases for high-benefit information (SH). 4) When information sharing accuracy is low, a firm only defers decisions in a fraction of SL; when information sharing accuracy is high, the firm defers its decisions in all SL and a fraction of SH. 5) Information sharing can improve the effect of deferral decision when accuracy is low but weaken it when accuracy is high. These results contradict the literature, wherein information sharing reduces a firm's uncertainty on cybersecurity investment and decreases deferment options associated with investment.