Misaligned Incentives

Many security failures are economic before they are technical. When responsibility, authority and incentive sit with different people, programs get scaled to the budget instead of the risk.

By Sonya Lowry · May 9, 2025 · 2 min read

A problem of economics

In 2006, Ross Anderson and Tyler Moore argued in Science that many security failures come from misaligned economic incentives and not from a lack of technology. The people best placed to manage security often lack the responsibility, the resources or the motivation to do it.

Three of their observations describe most security programs:

  • Programs often reward compliance over actual risk reduction.
  • The people who suffer the consequences of a breach are not always the people who control the systems.
  • Return on investment is hard to show, because the benefit of security is a loss that was avoided and was never certain.

How it shows up

Inside an organization, the pattern is easy to recognize. A unit that runs a system gets the benefit of running it. If the security team is believed to carry the risk, the unit has little reason to spend its own time managing that risk.

The security team is then held responsible for systems it does not run and cannot control. When responsibility, incentives and authority sit in different places, good intentions on every side still produce inertia.

Why the budget decides

In 2009, Russell Thomas added the idea of the total cost of security. He argued that ordinary investment models break down for security, because its benefits are uncertain losses avoided, and the uncertainty is too unruly to estimate reliably.

In practice, a conventional return-on-investment calculation often shows comprehensive security producing a negative return. So most programs are scaled to match the budget, and the risk is left to fit inside it. What Full Coverage Costs works through an example.

What a federated approach changes

Federated Cybersecurity moves responsibility to the people who control the resource, and gives them the authority and the knowledge to act on it. The three things that were separated are brought back together.

It also changes the cost. When the people closest to a resource do the routine work with good support, covering the whole organization becomes affordable.

How strongly the old belief is held varies from one organization to the next. The Ownership Conversation describes how to find out.

Sources

IncentivesOwnershipSecurity economicsFederated Cybersecurity