보호 네트워크의 보안관리서비스 제공자와 고객을 대상으로 세 계약 방식을 게임이론으로 비교한다. 보안 손실 위험이 커지면 고가치 고객이 정액형에서 비례형으로 이동하고, 부주의가 줄면 제공자의 시장 범위와 이익이 늘어난다. 위험과 계약별 부주의 차이가 중간이면 선택형이 제공자·고객·사회 모두에 유리하지만, 때로는 규제가 필요하다.
Abstract
Designing effective security service contracts presents a critical challenge for both Managed Security Service Providers (MSSPs) and their clients, driven by heterogeneous client risks, interdependent security externalities, and post-adoption client behaviors. Employing a game-theoretic framework, this research investigates an MSSP’s optimal contract strategy among three regimes: a fixed compensation contract (F-Contract), a proportional compensation contract (R-Contract), and a menu-based contract regime (M-Contract) that offers both options simultaneously, allowing clients to self-select. The differences in compensation structures between the F-Contract and R-Contract directly shape client behavior, resulting in varying levels of post-adoption client negligence. The menu-based contract design in our setting introduces a richer mechanism than simply segmenting heterogeneous clients: clients’ strategic migration across contract options changes the aggregate security of the protected network and, consequently, the MSSP’s optimal market coverage and profitability. As security loss risk increases, high-valuation clients migrate from fixed to proportional compensation. When this migration reduces aggregate negligence, it offsets the intensified negative externalities and induces the MSSP to expand, rather than contract, its client base and profits. Crucially, this reversal cannot arise under either pure contract regime or in screening models without contract-dependent behavior. We further show that no single regime always maximizes market coverage, MSSP profitability, or social welfare, as the optimal choice depends on the security loss risk and the negligence gap between the F- and R-Contracts. Specifically, when both factors are moderate, the M-Contract yields a “win-win-win” equilibrium that simultaneously advances the interests of the MSSP, clients, and social planners, requiring no external policy intervention. However, we also find that an MSSP’s privately optimal contract does not always inherently maximize social welfare. To address this, we characterize the conditions that call for targeted regulatory or contractual interventions to realign private and social incentives.