Â鶹Éç

This paper studies the welfare implications adoption of Data-Driven Technology (DDT) by a firm which sets consumer prices and invests in cybersecurity to deter attackers. We find that as the harm from attacks increases, consumer price always increases while investment in cyber security exhibits an inverse U-shaped behavior. These comparative statics are amplified when DDT is adopted as DDT adoption enhances consumer value through increased data use while making the firm a more attractive target for attackers. We find that firms adopt DDT when the harm amplification is limited. For sufficiently low harm amplification, this choice can also be consumer surplus enhancing and pareto optimal. Instead for intermediate levels of harm, DDT is adopted but this choice is detrimental to consumers. Here, the firm shifts the burden of cybersecurity on consumers by focusing on "containment via pricing" instead of "defense via investment". Our findings offer actionable insights for managing the security trade-off and navigating the economic incentives of cyberdefense.