Management Information Systems Quarterly
Abstract
Managed security service provider (MSSP) networks are a form of collaboration where several firms share resources such as diagnostics, prevention tools, and policies to provide security for their computer networks. While the decision to outsource the security operations of an organization may seem counterintuitive, there are potential benefits from joining an MSSP network that include pooling of risk and access to more security-enabling resources and expertise. We examine structural results explaining the reasons firms join an MSSP network, and characterize the growth of MSSP network size under different forms of ownership (monopoly versus consortium). We find that the need for an initial investment in MSSP networks (which is necessary to overcome the stalling effect) only affects the optimal network size for a consortium but has no impact on the optimal network size for a profit-maximizing monopolist. Our results provide an explanation why the majority of the MSSPs are for-profit entities and consortium-based MSSPs are less common. Such a market structure can be attributed to the potential for larger size by the for-profit MSSP owner combined with beneficial pricing structure and a lack of growth uncertainty for the early clients.