As cybersecurity threats become increasingly complex, more and more enterprises choose to outsource their security protection functions to professional managed security service providers (MSSPs). However, the choice of security outsourcing contracts faces a core dilemma: serving more clients certainly increases revenue, but a larger client base amplifies overall network risk through security externalities, forcing MSSPs to trade off between expanding coverage and controlling risk. Traditional contract screening models often treat clients as passive recipients and overlook the role of contract structure itself in shaping client behavior.
Against this backdrop, Associate Professor Yong Wu of the Glorious Sun School of Business and Management and his collaborators constructed a game-theoretic analytical framework that, for the first time, incorporates contract-dependent client negligence and endogenous network externalities into a unified model, and systematically compared the equilibrium outcomes of a fixed compensation contract (F-Contract), a proportional compensation contract (R-Contract), and a menu-based contract (M-Contract) that offers both options simultaneously. The related work, entitled "Fixed, Proportional, or Menu-based? A Study of Managed Security Service Provider Contracts," was published in Information Systems Research, a top-tier international journal in the field of information systems (one of the UTD 24 journals). This study systematically explores the optimal choice strategy of MSSPs among fixed, proportional, and menu-based contracts, revealing how contract structure reshapes the provider's market coverage and profitability by altering client security behavior and the composition of network risk.
The study finds that as security loss risk increases, high-valuation clients shift from the fixed compensation contract to the proportional compensation contract. Because the proportional compensation structure makes clients bear more of the cost in the event of an incident, clients become more cautious after adoption, thereby reducing the aggregate level of negligence. This change in client composition can offset the negative externalities brought by newly added clients, prompting the MSSP to expand, rather than reduce, its client coverage and profits—a "segmentation-driven expansion effect" that cannot arise under either pure contract regime or in traditional screening models.
(Combined result of the "segmentation-driven expansion effect" and the "externality-driven contraction effect")
Further analysis shows that no single contract form dominates for all clients. The optimal contract choice depends on the level of security loss risk and the negligence gap between the two contracts. When both are at moderate levels, the menu-based contract can simultaneously improve MSSP profits, client surplus, and social welfare, achieving a "win-win-win" equilibrium without any external policy intervention. However, an MSSP's privately optimal contract does not always coincide with the socially optimal contract, and the paper identifies the boundary conditions under which targeted regulation or contractual intervention can correct the welfare deviation. This study advances the function of the menu-based contract from the traditional "distinguishing client types" to "changing the composition of network risk," providing a new theoretical perspective for contract design in cybersecurity service governance.
(Optimal contract selection strategies for social welfare and the MSSP under different conditions)
Yong Wu and his PhD student Yujie Jiang are the co-first authors of the paper, together with Xinxue (Shawn) Qu of the Mendoza College of Business at the University of Notre Dame, USA, Qianzhou Du of the School of Management at the University of Science and Technology of China, and Professor Zhengrui Jiang of the School of Management and Economics at The Chinese University of Hong Kong, Shenzhen.
Paper link: https://doi.org/10.1287/isre.2024.1471
