Demonstration article

This sample was written to show how Northstar Briefing presents journalism. It does not report real events and contains no real quotations, data or named sources.

It is tempting to see digital security as a contest of skill between attackers and defenders. Yet many breaches exploit weaknesses that were well understood long before they were used: unpatched software, default passwords, poorly configured systems. The persistence of such gaps points to a problem of incentives rather than knowledge.

Misplaced costs

Economists describe the core difficulty as an externality. A company that ships insecure software, or a firm that neglects its own defences, does not bear the full cost when things go wrong. Customers, partners and the wider public absorb much of the damage — stolen data, disrupted services, compromised machines used to attack others. Software licences commonly disclaim responsibility for defects, and the chain of components inside a modern product is so long that it can be hard to say which supplier was at fault. When responsibility is diffuse, investment in prevention tends to be thin.

Information problems compound this. Buyers usually cannot tell how secure a product is, so they choose on price and features. Sellers who invest heavily in security struggle to be rewarded for it, which economists call a market for lemons: when quality is invisible, low quality tends to drive out high.

When the costs of insecurity fall on someone else, insecurity becomes a rational business choice.

Ways to realign incentives

Policy responses try to move costs back to those best placed to reduce risk. Some governments are exploring liability rules that make vendors responsible for foreseeable flaws. Others require disclosure of serious incidents, so that customers and investors can judge how well firms manage risk. Labelling schemes for connected devices aim to make security visible at the point of sale.

Levers for improving security

Liability for negligent design or delayed patching

Mandatory incident reporting

Security labels for consumer devices

Procurement standards for public buyers

Cyber insurance that prices risk

Each lever has drawbacks. Liability can deter innovation and invite litigation; reporting rules can create paperwork without improving defences; insurance markets struggle to price risks that are correlated across many customers at once. Critics also warn that rules written for large firms may burden small ones disproportionately.

Still, the economic lens explains why exhortation alone has achieved so little. Security improves fastest where somebody with the power to fix a problem also has a reason to care about it. That principle applies inside organisations as well: boards that treat cyber risk as a strategic matter, rather than a technical detail delegated to an IT department, tend to fund defences more consistently. The engineering of secure systems is difficult, but the harder task is arranging the incentives so that the engineering gets done.