Policy Perspectives Logo

The Journal of the Trachtenberg School of Public Policy and Public Administration at The George Washington University

Abstract

This paper applies economic theory to analyze market failures in AI-driven cybersecurity, focusing on the illicit market for stolen data. It examines foundational concepts such as externalities, information asymmetry, transaction costs, and behavioral economics to explain structural drivers of cyber insecurity. Using the 2021 Microsoft Exchange Server hack as a case study, the paper demonstrates how these economic forces manifest in real-world cyberattacks, including the disproportionate impacts on firms, customers, and society. The analysis highlights how misaligned incentives, opaque markets, and concentrated technological power exacerbate vulnerability and reduce the effectiveness of defense measures. Building on this framework, the paper identifies policy interventions aimed at realigning incentives, improving transparency, and fostering collaborative defense strategies in digital ecosystems. By integrating economic reasoning with cybersecurity analysis, it provides a systematic approach for understanding and addressing persistent market failures in the increasingly AI-mediated digital environment.

Full Text