Corporate Cybersecurity Investment Under Managerial Overconfidence: Strategic Attackers, Market Competition, and Regulatory Penalty

Abstract

This study examines how managerial overconfidence affects corporate cybersecurity investment and whether a breach-contingent regulatory penalty can mitigate behaviorally induced underinvestment. This study develops a behavioral game-theoretic model in which a firm chooses preventive cybersecurity investment and remedial cybersecurity investment, whereas a strategic attacker chooses attack effort, under three scenarios: rational decision making, managerial overconfidence, and managerial overconfidence with market competition. The results show that managerial overconfidence reduces cybersecurity investment by distorting perceptions of breach probability and breach losses. Specifically, breach-probability overconfidence mainly reduces preventive cybersecurity investment and increases attack effort, whereas underestimation of breach losses reduces both preventive cybersecurity investment and remedial cybersecurity investment. In addition, market competition has a conditional effect: it can strengthen preventive cybersecurity investment when managerial bias is mild but weaken it when managerial bias is strong. This study contributes by distinguishing two channels of managerial bias, identifying a conditional competition paradox, and clarifying the bounded corrective role of the breach-contingent regulatory penalty.

1. Introduction

The rapid expansion of digital technologies has substantially reshaped modern business operations while simultaneously exposing firms to growing cybersecurity risks [1]. Data breaches, ransomware attacks, and system intrusions have imposed substantial financial and reputational losses on firms worldwide. As a result, cybersecurity investment has become a strategic priority for corporate management [2]. To comply with cybersecurity standards and maintain market competitiveness, firms increasingly invest in technologies such as firewalls, intrusion detection systems, and antivirus software.

However, despite substantial cybersecurity spending, many firms continue to experience severe cyber incidents. Prior studies suggest that cybersecurity outcomes depend not only on technical safeguards but also on organizational and managerial factors [3]. In practice, cybersecurity investment decisions are often made under high uncertainty, complex threat environments, and time pressure, which may amplify the cognitive biases of decision-makers. Among these behavioral biases, managerial overconfidence is particularly relevant [4].

Managerial overconfidence refers to the tendency of decision-makers to overestimate their own capabilities and underestimate external risks [5]. Survey evidence also points to a gap between executive confidence and actual cyber exposure. In a global Kroll survey of finance executives, nearly $87\%$ reported confidence in their organizations’ cyber capabilities, while 61% said that their companies had experienced at least three significant cyber incidents in the previous 18 months [6]. This mismatch indicates that overconfidence may be an important issue in organizational cybersecurity decision making. In the cybersecurity context, the overconfidence may lead managers to believe that existing systems are sufficiently robust, resulting in insufficient preventive cybersecurity investment and remedial cybersecurity investment [7]. Moreover, well-known cases such as Equifax illustrate the severe consequences that can follow weak cybersecurity governance.

At the same time, corporates rarely operate in isolation. Market competition strongly shapes both corporate strategies and cybersecurity incentives [8]. Competitive pressure may encourage corporates to strengthen cybersecurity to protect market share and reputation, but it may also intensify cost-cutting pressures and discourage long-term security investment. High-profile cyber incidents also suggest that breaches can damage customer trust, disrupt operations, and weaken corporates’ competitive positions [9,10]. The interaction among managerial overconfidence, market competition, and strategic attackers’ behavior, therefore, creates complex dynamics in cybersecurity decision making.

Although the existing literature has examined cybersecurity investment from economic and technological perspectives, important gaps remain. Existing studies have largely developed along two separate lines. One stream focuses on strategic attackers and market competition, examining how they shape corporate cybersecurity decisions [11,12,13]. The other stream focuses on managerial behavioral biases, showing that overconfidence and related cognitive distortions can bias cybersecurity judgment [14,15]. However, these two research streams have not yet been integrated into a unified formal model. To address this gap, this study develops a behavioral game-theoretic framework to analyze corporate cybersecurity investment under managerial overconfidence, strategic attackers, and market competition. Unlike the existing literature, this study does not examine managerial behavioral bias or strategic attackers separately. Instead, it incorporates both into a corporate-attacker behavioral game framework and further distinguishes between preventive cybersecurity investment and remedial cybersecurity investment.

Accordingly, this study addresses three research questions:

• RQ1. How does managerial overconfidence affect the preventive cybersecurity investment and remedial cybersecurity investment?
• RQ2. How does market competition affect corporate cybersecurity investment under managerial overconfidence?
• RQ3. Can a breach-contingent regulatory penalty improve cybersecurity investment incentives, and under what conditions is its effect bounded?

This study makes three main contributions. First, it analyzes the economic consequences of managerial overconfidence from a cost–benefit perspective and shows how biased perceptions of breach probability and breach losses distort corporate cybersecurity investment decisions. Second, it models corporate cybersecurity investment as a sequential decision process in which preventive cybersecurity investment is chosen before remedial cybersecurity investment, thereby capturing the linkage between the two types of investment. Third, it places corporate cybersecurity investment in a corporate-attacker strategic interaction framework. In doing so, it moves beyond the conventional treatment of information security investment as a one-sided corporate decision and extends the analytical perspective of the cybersecurity investment literature.

The remainder of this paper is organized as follows. Section 2 reviews the related literature. Section 3 presents the game-theoretic model and equilibrium analysis. Section 4 reports the numerical simulation results. Section 5 discusses the managerial and policy implications. Section 6 concludes the paper.

2. Literature Review and Research Gaps

2.1. The Economics of Cybersecurity Investment

Cybersecurity investment has long been studied from an economic perspective, with early studies focusing on cost–benefit trade-offs under uncertainty and the conditions under which corporates should invest in protection [16,17]. Recent studies have extended this line of research in three directions. First, multi-corporate and supply-chain settings show that interdependent risk and information exchange reshape equilibrium cybersecurity investment [18,19,20]. Second, competition-based models show that cybersecurity affects both breach prevention and product-market competition, and that stronger competition does not always increase security investment [21,22]. Third, recent attacker-aware studies show that optimal investment can differ across attack types and risk-propagation structures [23,24]. Overall, recent research has moved beyond the single-corporate benchmark toward settings with interdependence, competition, and strategic interaction [12,23].

These advances make the literature more consistent with real-world conditions, but recent evidence also points to a more complex pattern than a simple “more risk, more investment” logic. Gao and Yang [12] show that corporates may reduce information security investment when stronger competition increases the value of security differentiation. De Cornière and Taylor [13] similarly show that the effect of competition depends on firms’ business models. Dash et al. [21] further show that targeted and opportunistic attacks can imply different optimal investment levels across supply-chain members. Overall, recent studies increasingly treat cybersecurity investment as a strategic choice shaped by market structure and interdependence rather than as a purely technical budgeting decision [13,21].

However, most recent studies still assume unbiased decision-makers and, therefore, do not explain how distorted managerial beliefs reshape cybersecurity investment choices [23]. In addition, the literature usually focuses on overall cybersecurity spending or corporate-level security choices, while paying less attention to the allocation between preventive cybersecurity investment and remedial cybersecurity investment. As a result, it provides limited explanation of how firms allocate cybersecurity resources when managerial judgment is biased [3,8].

2.2. Managerial Overconfidence and Behavioral Cybersecurity

Recent studies suggest that cybersecurity decisions are not always made under unbiased cognition, but are often influenced by managerial behavioral biases, particularly overconfidence. In this context, managerial overconfidence can distort managers’ judgments about cybersecurity risks, attack consequences, and the returns to protection, thereby affecting corporates’ cybersecurity investment decisions [8,14]. Existing research shows that overconfidence may lead decision-makers to overestimate their ability to control cybersecurity risks while underestimating the likelihood of cybersecurity threats [25]. Corporate-level empirical evidence further indicates that managerial overconfidence is negatively associated with cybersecurity investment [8].

Nevertheless, the existing literature has largely treated overconfidence as a relatively general behavioral tendency, with limited attention to its distinct channels of influence in cybersecurity investment [15,26]. From a theoretical perspective, a more analytically meaningful distinction in the cybersecurity context is that between breach-probability overconfidence and underestimation of breach losses. The former is mainly reflected in an underestimation of the probability of a breach, which weakens managers’ perception of the need for prevention and, therefore, more directly suppresses preventive cybersecurity investment. The latter is reflected in an underestimation of breach losses, which not only weakens managers’ assessment of the value of prevention, but also reduces their perceived need for post-breach recovery and remediation, thereby potentially reducing both preventive cybersecurity investment and remedial cybersecurity investment. These two biases, thus, both reflect forms of overconfidence, but differ in their mechanisms and investment implications.

From the perspective of behavioral cybersecurity, cybersecurity investment is not merely a passive response to objective technical threats, but is also shaped by managers’ subjective cognition and behavioral judgment [14]. In this sense, managerial overconfidence should not be viewed simply as a broad managerial trait, but, rather, as an important behavioral mechanism affecting corporates’ cybersecurity investment; correspondingly, distinguishing breach-probability overconfidence from underestimation of breach losses helps clarify how different cognitive distortions generate heterogeneous effects on preventive cybersecurity investment and remedial cybersecurity investment [15].

2.3. Strategic Attackers’ Behavior

Cybersecurity research must also account for strategic attackers’ behavior. Attackers are not fixed background risks. Instead, they adjust target selection and attack effort in response to corporates’ cybersecurity postures and expected returns [11]. This perspective has been strengthened by recent studies that explicitly model attackers as rational decision-makers. Ebel and Mitra [23], for example, show that defender investment and attacker effort should be analyzed in one economic framework, because each side responds to the other’s incentives. This perspective is especially relevant in corporate settings, where attackers can shift attention toward weakly defended corporates or toward targets that promise higher payoffs [23].

Recent work also extends this studies in two directions. One direction examines strategic interaction under interdependence and timing. Huang et al. [27] show that first-mover advantage affects free riding and security underinvestment in interdependent security games. Another direction emphasizes attacker learning and knowledge dissemination [28]. Gao [29] shows that hacker knowledge dissemination can alter equilibrium cybersecurity investment, especially in competitive settings. These studies suggest that attacker adaptation, information diffusion, and interaction structure can materially change corporates’ defensive incentives [23,29].

At the same time, the recent studies still do not fully integrate strategic attackers, market competition, and managerial bias in one framework. Studies on competitive cybersecurity investment usually assume unbiased decision-makers [12,13]. Studies on strategic attackers explain why corporates may underinvest when attackers respond endogenously, but they rarely distinguish breach-probability bias from breach-loss bias, and they usually do not separate preventive cybersecurity investment from remedial cybersecurity investment [11,29]. As a result, the studies still provide limited explanation of how market competition and attacker adaptation interact with managerial overconfidence to shape corporate cybersecurity investment.

2.4. Research Gaps and Contributions

Although the literature on cybersecurity economics has established a solid theoretical foundation, several important gaps remain.

First, the dominant stream of research still relies heavily on rational decision-maker assumptions [30,31]. Although this literature has generated important insights into cybersecurity investment, interdependence, and regulation, it mainly explains how corporates should invest under rational decision making rather than why they continue to underinvest in cybersecurity in practice. As a result, the role of managerial bias in shaping cybersecurity investment remains insufficiently examined.

Second, behavioral studies suggest that overconfidence and unrealistic optimism can distort risk perception and corporate decision making [8,25]. However, the existing literature remains fragmented: some studies focus on individual judgment errors, while others document corporate-level correlations. Few studies incorporate managerial overconfidence into formal cybersecurity investment models, and even fewer examine its distinct effects on preventive cybersecurity investment and remedial cybersecurity investment.

Third, the literature on strategic attackers, interdependent cybersecurity, and market competition has advanced significantly [12], but these studies mainly examine corporate incentives under strategic interaction and pay limited attention to managerial bias [23,27]. As a result, the joint influence of managerial overconfidence, competitive pressure, and strategic attackers’ behavior remains insufficiently understood.

Recent research suggests that cybersecurity investment is increasingly shaped by compliance and data governance. In the United States, tightening requirements on cybersecurity risk disclosure, information security governance, and data protection responsibilities have pushed corporates to place cybersecurity within a more formal compliance and governance framework [32,33]. In China, the Data Security Law, the Personal Information Protection Law, and the Measures for Security Assessment of Outbound Data Transfers have further strengthened legal requirements for data handling, personal information protection, and cross-border data governance [34,35,36]. Against this institutional background, recent studies pay growing attention to regulatory effects and compliance governance [37,38,39]. However, this literature mainly focus on external legal constraints and their regulatory outcomes, while paying insufficient attention to the interaction between regulatory requirements and managerial behavioral biases within corporates. Research on reward–penalty mechanisms also shows that regulatory incentives can affect cybersecurity investment [40], but it does not explain whether a breach-contingent regulatory penalty can correct underinvestment caused by different forms of managerial overconfidence.

To address these gaps, this study develops a behavioral game-theoretic framework to analyze corporate cybersecurity investment under managerial bias, strategic attackers, and market competition. The analysis focuses on two distinct distortions in managerial perception—breach-probability overconfidence and underestimation of breach losses—and examines when market competition weakens preventive cybersecurity investment. It also evaluates whether a breach-contingent regulatory penalty can serve as a corrective mechanism and under what conditions its effect remains bounded.

3. Game-Theoretic Modeling and Equilibrium Analysis

Managerial overconfidence, strategic attackers’ behavior, and market competition are key factors influencing corporate cybersecurity investment. To analyze these interactions, this section develops a two-stage game-theoretic model involving a representative firm (Firm i), a competing peer (Firm j), and a strategic attacker [11]. The model is solved by backward induction under three scenarios: (1) a fully rational baseline, (2) managerial overconfidence, and (3) market competition.

3.1. Model Assumptions and Parameter Definitions

Following previous studies on information security investment, this study adopts a simple benchmark setting to isolate the core mechanisms linking managerial overconfidence, market competition, and regulatory penalty [11,20]. Prior research shows that simplified analytical structures are common in this literature. For example, Qian et al. [20] examine information security investment for multiple firms in a network and explicitly assume that “all the n firms are homogeneous”, whereas Wu et al. [11] examine “the interaction between firms in a specific industry and a strategic hacker” and further extend their model to “the case of sequential game and the case of asymmetric condition”. Building on these studies, this study models a representative firm, a competing peer, and a representative strategic attacker in a benchmark two-stage game. This setting is intended to characterize the relationships among the core variables within a simple analytical framework and to provide a benchmark for later extensions to more complex settings, rather than to suggest that real-world firms, attackers, and interactions are fully symmetric or static. This benchmark setting is useful for the analysis in two respects. First, it helps clarify the relationships among the core variables and makes the underlying mechanisms easier to identify [11]. Second, it preserves analytical clarity and facilitates comparative static analysis, thereby providing a benchmark for later extensions to more complex settings [20].

The game unfolds in two stages. In Stage 1, the firm chooses preventive cybersecurity investment ($I_p$), while the strategic attacker simultaneously chooses attack effort ($\rho$). In Stage 2, if a cybersecurity breach occurs, the firm chooses remedial cybersecurity investment ($I_r$) to reduce post-breach losses.

The main model parameters and their definitions are summarized in Table 1.

Table 1. Model parameters and definitions.

Symbol	Definition
c	The marginal cost coefficient for the firm’s preventive cybersecurity investment
$c_r$	The marginal cost coefficient for the firm’s remedial cybersecurity investment
$A_0$	The initial asset value of Firm i before security investment and breach losses
$I_{pi},I_{ri}$	Preventive and remedial cybersecurity investments of Firm i
${\rho }_i$	The strategic attacker’s effort directed at Firm i
v	The inherent system vulnerability of the Firm
L	The potential direct loss from a successful intrusion
$p(I_{pi},{\rho }_i)$	The probability of a successful breach, defined as $p_i=v{\rho }_i·\exp (-\alpha I_{pi})$
$\alpha$	The efficiency of preventive cybersecurity investment
$L_{\mathrm{after}}\left(I_{ri}\right)$	The residual loss after remedial cybersecurity investment, defined as $L_{\mathrm{after}}=L·\exp (-\mu I_{ri})$
$\mu$	The efficiency of remedial cybersecurity investment
${\theta }_p,{\theta }_L$	Managerial overconfidence parameters regarding breach probability and potential loss ($0<\theta \le 1$) [21]
B	The strategic attacker’s financial reward from a successful intrusion (e.g., black-market value of stolen data)
k	The marginal cost coefficient of the strategic attacker’s effort
$\Delta$	Additional indirect loss incurred due to market competition when Firm i is breached but its competitor is not
E	The mathematical expectation operator representing the expected value
m	A regulatory penalty imposed by social planners in the event of a breach

3.2. Scenario 1: Rational Decision-Maker Without Market Competition (Baseline)

In this baseline scenario, the decision-maker is assumed to be fully rational (${\theta }_p=1,{\theta }_L=1$) and market competition is absent ($\Delta =0$).

We first define the expected payoff of the strategic attacker ($U_S$). The strategic attacker’s payoff equals the expected value of stolen information assets minus the cost of attack effort:

$$U_S\left({\rho }_i\right)=p_{i}B-k{\rho }_i$$

(1)

Substituting the breach probability function $p_i=\nu ·{\rho }_i·\exp (-\alpha I_{pi})$:

$$U_S\left({\rho }_i\right)=\nu {\rho }_i·\exp (-\alpha I_{pi})B-k{\rho }_i$$

(2)

Similarly, the expected payoff of Firm i ($U_{Fi}$) is defined as follows. The firm seeks to maximize its initial asset value $A_0$ minus the cost of preventive cybersecurity investment and the expected residual loss following a successful breach.

$$U_{Fi}\left(I_{pi}\right)=A_0-{\displaystyle \frac{1}{2}}c{I}_{pi}^2-p_i{L}_{\mathrm{after}}$$

(3)

where ${\displaystyle \frac{1}{2}}c{I}_{pi}^2$ denotes the quadratic cost of preventive cybersecurity investment.

Using backward induction, we first analyze Stage 2. If an attack is successful, Firm i chooses $I_{ri}$ to minimize its total post-breach costs, which consists of remedial cybersecurity investment cost and residual loss $L·\exp (-\mu I_{ri})$. The first-order condition (FOC) with respect to $I_{ri}$ is

$${\displaystyle \frac{\partial \left(\mathrm{Total}\mathrm{Cost}\right)}{\partial I_{ri}}}=c_r{I}_{ri}-\mu L·\exp (-\mu I_{ri})=0$$

(4)

Solving this condition yields the optimal remedial cybersecurity investment:

$$I_{ri}^{*}={\displaystyle \frac{1}{\mu }}·{\displaystyle \frac{\ln \left(\mu L\right)}{c_r}}$$

(5)

We then turn to Stage 1, in which the firm and the strategic attacker simultaneously optimize their respective payoff functions. Taking the first partial derivative of the strategic attacker’s payoff function with respect to attack effort ${\rho }_i$ and setting it to zero:

$${\displaystyle \frac{\partial U_S}{\partial {\rho }_i}}=\nu ·\exp (-\alpha I_{pi})B-k=0$$

(6)

Taking the first partial derivative of the firm’s payoff function with respect to preventive cybersecurity investment $I_{pi}$ and setting it to zero:

$${\displaystyle \frac{\partial U_{Fi}}{\partial I_{pi}}}=-c{I}_{pi}+\alpha \nu {\rho }_i·\exp (-\alpha I_{pi})L_{\mathrm{after}}=0$$

(7)

Solving these simultaneous equations yields the baseline equilibrium:

Optimal preventive cybersecurity investment:

$$I_{pi}^{*}={\displaystyle \frac{1}{\alpha }}·\ln {\displaystyle \frac{\alpha {\nu }^2{L}_{\mathrm{after}}B}{ck}}$$

(8)

Optimal attack effort:

$${\rho }_i^{*}={\displaystyle \frac{ck}{\alpha \nu B{L}_{\mathrm{after}}}}{I}_{pi}^{*}$$

(9)

3.3. Scenario 2: Overconfident Decision-Maker Without Market Competition

We now introduce managerial overconfidence. The decision-maker underestimates the breach probability, perceived as ${\theta }_p·p_i$, and the potential loss, perceived as ${\theta }_L·L$.

In Stage 2, the overconfident manager chooses remedial cybersecurity investment based on the distorted perception of breach losses. The perceived total post-breach cost function is

$$\mathrm{Perceived}\mathrm{Cost}={\displaystyle \frac{1}{2}}{c}_r{I}_r^2+{\theta }_{L}L·\exp (-\mu I_r)$$

(10)

Taking the first derivative with respect to $I_r$ and setting it to zero:

$${\displaystyle \frac{\partial \left(\mathrm{Perceived}\mathrm{Cost}\right)}{\partial I_{ri}}}=c_r{I}_{ri}-\mu {\theta }_{L}L·\exp (-\mu I_{ri})=0$$

(11)

Solving this condition yields the optimal remedial cybersecurity investment under managerial overconfidence:

$$I_{ri}^{\mathrm{overconfident}}={\displaystyle \frac{1}{\mu }}·{\displaystyle \frac{\ln \left({\theta }_L\mu L\right)}{c_r}}$$

(12)

Moving to Stage 1, the firm chooses preventive cybersecurity investment based on its distorted perceptions, whereas the strategic attacker is fully rational and observes the firm’s true vulnerability. The strategic attacker’s expected payoff function, $U_S$, continues to depend on the true breach probability:

$$U_S\left({\rho }_i\right)={\rho }_{i}B-k{\rho }_i=v{\rho }_i·\exp \left(-\alpha I_{pi}\right)B-k{\rho }_i$$

(13)

By contrast, the firm’s perceived expected payoff function, $U_{Fi}^{\mathrm{overconfident}}$, is distorted by both the breach-probability bias (${\theta }_p$) and the breach-loss bias (${\theta }_L$). The firm maximizes its initial asset value minus the quadratic cost of preventive cybersecurity investment and the perceived expected loss:

$$U_{Fi}^{\mathrm{overconfident}}\left(I_{pi}\right)=A_0-{\displaystyle \frac{1}{2}}c{I}_{pi}^2-{\theta }_p{p}_i{L}_{\mathrm{after}}^{\mathrm{overconfident}}$$

(14)

where

$$L_{\mathrm{after}}^{\mathrm{overconfident}}={\theta }_{L}L·\exp (-\mu I_{ri}^{\mathrm{overconfident}})$$

(15)

To derive the subgame perfect equilibrium, we take the first-order conditions of both payoff functions. For the rational strategic attacker, the first-order condition (FOC) is

$${\displaystyle \frac{\partial U_S}{\partial {\rho }_i}}=\nu ·\exp (-\alpha I_{pi})B-k=0$$

(16)

For the overconfident firm, the FOC with respect to preventive cybersecurity investment is

$${\displaystyle \frac{\partial U_{Fi}^{\mathrm{overconfident}}}{\partial I_{pi}}}=-c{I}_{pi}+\alpha {\theta }_p\nu {\rho }_i·\exp (-\alpha I_{pi})L_{\mathrm{after}}^{\mathrm{overconfident}}=0$$

(17)

Solving this system yields the equilibrium level of preventive cybersecurity investment under managerial overconfidence:

$$I_{pi}^{\mathrm{overconfident}}={\displaystyle \frac{1}{\alpha }}\ln {\displaystyle \frac{\alpha {\theta }_p{\nu }^2{L}_{\mathrm{after}}^{\mathrm{overconfident}}B}{ck}}$$

(18)

Proposition 1

(Impact of Overconfidence).

• Greater breach-probability overconfidence (lower ${\theta }_p$) reduces preventive cybersecurity investment but has no direct effect on remedial cybersecurity investment. The resulting reduction in defense increases both the strategic attacker’s effort and expected payoff.
• Greater underestimation of breach losses (lower ${\theta }_L$) reduces both preventive cybersecurity investment and remedial cybersecurity investment.

Explanation. This proposition identifies two distinct channels through which managerial overconfidence affects cybersecurity investment. Breach-probability overconfidence weakens the firm’s ex ante incentive to invest in prevention, thereby making the target more attractive to the strategic attacker. By contrast, underestimation of breach losses weakens both preventive cybersecurity investment and post-breach remedial cybersecurity investment because managers discount the expected value of both protection and recovery.

3.4. Scenario 3: Overconfident Decision-Maker with Market Competition

We now introduce market competition factor ($\Delta >0$). When Firm i is breached while Firm j is not, Firm i incurs an additional reputational and competitive loss, $\Delta$.

In this setting, the strategic attacker’s objective payoff function remains unchanged because the attacker’s reward (B) depends primarily on the black-market value of stolen assets rather than the firm’s competitive standing:

$$U_S\left({\rho }_i\right)=v{\rho }_i·\exp (-\alpha I_{pi})B-k{\rho }_i$$

(19)

However, the firm’s perceived expected payoff function in Stage 1 must now incorporate the competitive penalty $\Delta$. The updated payoff function ($U_{Fi}^{comp}$) becomes

$$U_{Fi}^{comp}\left(I_{pi}\right)=A_0-{\displaystyle \frac{1}{2}}c{I}_{pi}^2-E\left[{\theta }_p{p}_i(L_{\mathrm{after}}^{\mathrm{overconfident}}+\Delta )\right]$$

(20)

Substituting the explicit breach probability formulation, we get

$$U_{Fi}^{comp}\left(I_{pi}\right)=A_0-{\displaystyle \frac{1}{2}}c{I}_{pi}^2-{\theta }_{p}v{\rho }_i·\exp (-\alpha I_{pi})·(L_{\mathrm{after}}^{\mathrm{overconfident}}+\Delta )$$

(21)

Taking the first-order derivative with respect to $I_{pi}$:

$${\displaystyle \frac{\partial U_{Fi}^{comp}}{\partial I_{pi}}}=-c{I}_{pi}+\alpha {\theta }_{p}v{\rho }_i·\exp (-\alpha I_{pi})(L_{\mathrm{after}}^{\mathrm{overconfident}}+\Delta )=0$$

(22)

Combining this condition with the strategic attacker’s unchanged first-order condition yields the equilibrium level of preventive cybersecurity investment under market competition:

$$I_{pi}^{comp}={\displaystyle \frac{1}{\alpha }}ln{\displaystyle \frac{\alpha {\theta }_p{v}^2(L_{\mathrm{after}}^{\mathrm{overconfident}}+\Delta )B}{ck}}$$

(23)

The effect of market competition on preventive cybersecurity investment reflects two opposing forces. On the one hand, competition raises the expected cost of a breach and tends to increase preventive cybersecurity investment. On the other hand, managerial overconfidence discounts breach probability and competitive loss, thereby weakening this incentive. As a result, competition strengthens preventive cybersecurity investment under mild overconfidence but reduces it under strong overconfidence.

Proposition 2

(Conditional Effect of Market Competition). Market competition has a conditional effect on preventive cybersecurity investment. When managerial overconfidence is mild, stronger competition increases preventive cybersecurity investment. When managerial overconfidence is sufficiently strong, stronger competition reduces preventive cybersecurity investment and generates the competition paradox.

Explanation. Market competition has two opposing effects in the model. Stronger competition increases the expected cost of a breach and can strengthen preventive cybersecurity investment. However, when managerial bias is strong, managers discount both breach risk and competitive loss. The net effect, therefore, depends on which force dominates.

3.5. Incentive Mechanism Design (Regulatory Penalty)

To mitigate underinvestment caused by managerial overconfidence and strong market competition, we introduce a breach-contingent regulatory penalty. Suppose that a social planner (or government regulator) imposes a deterministic financial penalty, m ($m>0$), on the firm if a successful cyber breach occurs.

With the introduction of m, the strategic attacker’s objective payoff remains unchanged because the regulatory fine is imposed on the firm rather than transferred to the strategic attacker. However, the firm’s perceived expected payoff function must be reformulated. The new perceived payoff function, ($U_{Fi}^{reg}$), becomes

$$U_{Fi}^{reg}\left(I_{pi}\right)=A_0-{\displaystyle \frac{1}{2}}c{I}_{pi}^2-E\left[{\theta }_p{p}_i(L_{\mathrm{after}}^{\mathrm{overconfident}}+\Delta +m)\right]$$

(24)

Substituting the explicit breach probability formulation, we obtain

$$U_{Fi}^{reg}\left(I_{pi}\right)=A_0-{\displaystyle \frac{1}{2}}c{I}_{pi}^2-{\theta }_{p}v{\rho }_i·\exp (-\alpha I_{pi})(L_{\mathrm{after}}^{\mathrm{overconfident}}+\Delta +m)$$

(25)

To derive the new subgame perfect equilibrium under regulation, we take the first-order condition of this updated payoff function with respect to $I_{pi}$:

$${\displaystyle \frac{\partial U_{Fi}^{reg}}{\partial I_{pi}}}=-c{I}_{pi}+\alpha {\theta }_{p}v{\rho }_i·\exp (-\alpha I_{pi})(L_{\mathrm{after}}^{\mathrm{overconfident}}+\Delta +m)=0$$

(26)

Substituting the strategic attacker’s optimal attack effort (${\rho }_i^{*}$) into this condition yields the firm’s optimal preventive cybersecurity investment under regulation:

$$I_{pi,reg}^{*}={\displaystyle \frac{1}{\alpha }}ln{\displaystyle \frac{\alpha {\theta }_p{v}^2(L_{\mathrm{after}}^{\mathrm{overconfident}}+\Delta +m)B}{ck}}$$

(27)

To evaluate the effectiveness of this regulatory penalty, we take the partial derivative of the optimal preventive cybersecurity investment ($I_{pi,reg}^{*}$) with respect to the penalty parameter m:

$${\displaystyle \frac{\partial I_{pi,reg}^{*}}{\partial m}}={\displaystyle \frac{1}{\alpha (L_{\mathrm{after}}^{\mathrm{overconfident}}+\Delta +m)}}>0$$

(28)

Proposition 3

(Effectiveness of Regulation). An increase in the regulatory penalty (m) increases the firm’s preventive cybersecurity investment, thereby offsetting the negative effects of managerial overconfidence and market competition. As a result, the strategic attacker’s expected payoff decreases.

Explanation. A breach-contingent regulatory penalty raises the expected cost of a successful breach borne by the firm. This strengthens preventive cybersecurity investment incentives even when managerial perceptions are biased. At the same time, the result implies that the penalty should be calibrated carefully, because an excessively high penalty may reduce firm payoff.

4. Numerical Simulation

To illustrate the comparative-static implications of Section 3, we conduct numerical simulations in MATLAB R2025a. This section translates our abstract game-theoretic equilibria into observable behavioral trajectories under varying cognitive and environmental conditions.

4.1. Parameter Setting

The baseline parameter setting in this study is designed as a benchmark based on prior studies and reflects a representative corporate cybersecurity environment. The baseline simulation uses the following parameter values: $\alpha =0.6$, $\mu =0.7$, $\nu =0.6$, $L=80$, $B=30$, and the cost coefficients are normalized to 1. Parameters related to defensive effectiveness, vulnerability, and investment cost structure (e.g., $\alpha$, $\mu$, $\nu$, and the cost coefficients) are mainly based on prior analytical studies of cybersecurity investment [17,18,41], because these studies provide the basic economic framework for linking vulnerability, technical effectiveness, and cybersecurity investment. Parameters related to strategic attacker behavior and market competition are mainly informed by attacker–defender and competitive cybersecurity studies [12,23,29], which are more suitable for capturing attacker adaptation and competitive interaction. In addition, the setting of breach loss, attacker reward, and breach-contingent regulatory penalty is aligned with the general patterns documented in real-world evidence on cyber incidents, attacker incentives, and post-breach governance pressure [24,39,42].

The behavioral parameters ${\theta }_P$ and ${\theta }_L$ denote the manager’s perceived breach probability and perceived breach loss relative to their objective values, respectively. Because the model focuses on underestimation induced by managerial overconfidence, both parameters are restricted to the interval $(0,1]$. When ${\theta }_P=1$ and ${\theta }_L=1$, the manager is unbiased; lower values indicate stronger underestimation of breach probability and breach loss, respectively. This specification is consistent with the literature on overconfidence and optimistic bias, which suggests that decision-makers may underestimate both the likelihood of adverse events and the severity of their consequences [14,15,43]. Because the existing cybersecurity studies still provide limited firm-level evidence that separately identifies these two bias channels, we do not treat ${\theta }_P$ and ${\theta }_L$ as empirically estimated structural parameters, but, rather, as bounded perception-bias parameters. In the simulations, both vary from 0.2 to 1.0 to represent cases ranging from substantial, but still realistic, underestimation to unbiased judgment. This interval is used as a conservative scenario range to cover the main behavioral distortion cases while avoiding extreme values that would imply an almost complete neglect of breach risk or breach loss [43].

To make the structure of the simulation section clearer, the following subsections are organized in line with the research questions. Section 4.2 and Section 4.3 address RQ1 by separately examining the effects of breach-probability overconfidence and underestimation of breach losses on corporate cybersecurity investment. Section 4.4 addresses RQ2 by showing how market competition affects corporate cybersecurity investment under managerial overconfidence. Section 4.5 and Section 4.6 address RQ3 by evaluating the incentive effect and boundary conditions of the breach-contingent regulatory penalty.

4.2. Sensitivity Analysis on Breach Probability Overconfidence (${\theta }_p$)

Under the baseline parameter setting, the breach-probability overconfidence parameter ${\theta }_p$ is varied from 0.2 to 1.0, while the other baseline values are held constant. The main outputs are preventive cybersecurity investment, strategic attacker’s effort, and expected payoffs. Figure 1 shows the expected payoffs of the firm and the strategic attacker under different values of ${\theta }_p$. As ${\theta }_p$ decreases, the strategic attacker’s expected payoff increases, whereas the firm’s perceived expected payoff remains relatively stable in the short run. Figure 2 shows preventive cybersecurity investment and strategic attacker’s effort under different values of ${\theta }_p$. A lower ${\theta }_p$ reduces preventive cybersecurity investment and increases strategic attacker’s effort. These results are consistent with Proposition 1. Breach-probability overconfidence weakens the firm’s perceived need for preventive cybersecurity investment and thereby makes the target more attractive to the strategic attacker.

Figure 1. Expected payoffs under probability overconfidence.

Figure 2. Preventive cybersecurity investment and strategic attacker’s effort under probability overconfidence.

Overall, this subsection addresses RQ1 by showing how breach-probability overconfidence affects preventive cybersecurity investment.

4.3. Sensitivity Analysis on Underestimation of Breach Losses (${\theta }_L$)

Under the baseline parameter setting, the breach-loss underestimation parameter ${\theta }_L$ is varied from 0.2 to 1.0, while the other baseline values are held constant. The main outputs are preventive cybersecurity investment, remedial cybersecurity investment, strategic attacker’s effort, and expected payoffs. Figure 3 shows expected payoffs under different values of ${\theta }_L$. As ${\theta }_L$ decreases, the firm’s perceived expected payoff increases in the short run because current cybersecurity spending declines. Figure 4 shows preventive cybersecurity investment, remedial cybersecurity investment, and strategic attacker’s effort under different values of ${\theta }_L$. A lower ${\theta }_L$ reduces both preventive cybersecurity investment and remedial cybersecurity investment. As preventive cybersecurity investment declines, strategic attacker’s effort increases. These results are also consistent with Proposition 1. Underestimation of breach losses weakens both preventive cybersecurity investment and post-breach loss mitigation, thereby increasing the firm’s exposure once a breach occurs.

Figure 3. Expected payoffs under loss underestimation.

Figure 4. Cybersecurity investments and strategic attacker’s effort under loss underestimation.

Overall, this subsection further addresses RQ1 by showing that underestimation of breach losses affects both preventive cybersecurity investment and remedial cybersecurity investment.

4.4. Sensitivity Analysis on Market Competition ($\Delta$)

Under the baseline parameter setting, market competition $\Delta$ is varied from 0 to 20, while the other baseline values are held constant. The main outputs are preventive cybersecurity investment, strategic attacker’s effort, and the firm’s expected payoff. Figure 5 shows the firm’s expected payoff under different values of $\Delta$. The firm’s expected payoff may increase slightly when competition is low, but it declines once competition becomes sufficiently strong. Figure 6 shows preventive cybersecurity investment and strategic attacker’s effort under different values of $\Delta$. Stronger market competition reduces preventive cybersecurity investment and increases strategic attacker’s effort under managerial bias. These results are consistent with Proposition 2. Market competition does not always strengthen cybersecurity incentives. When managerial bias distorts threat perception, competition can reverse its usual disciplining effect and give rise to the competition paradox.

Figure 5. Expected payoffs under market competition.

Figure 6. Preventive cybersecurity investment and strategic attacker’s effort under market competition.

These results address RQ2 by showing that the effect of market competition on corporate cybersecurity investment is conditional: when managerial overconfidence is mild, market competition strengthens preventive cybersecurity investment, whereas when managerial overconfidence is strong, it weakens preventive cybersecurity investment.

4.5. Evaluating the Regulatory Incentive Mechanism (m)

Under the baseline parameter setting, the breach-contingent regulatory penalty m is varied while the other baseline values are held constant. The main outputs are preventive cybersecurity investment, strategic attacker’s effort, and expected payoffs. Figure 7 shows expected payoffs under different values of m. The firm’s expected payoff improves within a moderate range of penalties but declines when the penalty becomes excessively high ($m>30$). Figure 8 shows preventive cybersecurity investment and strategic attacker’s effort under different values of m. A higher penalty increases preventive cybersecurity investment and reduces strategic attacker’s effort. These results are consistent with Proposition 3. A breach-contingent regulatory penalty can mitigate behaviorally induced underinvestment, but its corrective effect is bounded because excessively high penalties reduce firm payoff.

Figure 7. Expected payoffs under regulatory penalty.

Figure 8. Preventive cybersecurity investment and strategic attacker’s effort under regulatory penalty.

Overall, this subsection addresses RQ3 by showing that the breach-contingent regulatory penalty can improve cybersecurity investment incentives, although its corrective effect is not unlimited.

4.6. Dynamic Calibration of the Optimal Regulatory Penalty

We next examine how the optimal breach-contingent regulatory penalty changes under different competitive and behavioral conditions. The manipulated variables are market competition $\Delta$, breach-probability overconfidence ${\theta }_p$, and underestimation of breach losses ${\theta }_L$. The main output is the optimal regulatory penalty. Figure 9 shows the optimal regulatory penalty under different values of market competition $\Delta$. When managerial bias is mild, the required penalty remains relatively stable. When market competition becomes stronger under severe managerial bias, the required penalty increases. Figure 10 shows the optimal regulatory penalty under different values of ${\theta }_p$. The optimal penalty increases as breach-probability overconfidence becomes more severe.

Figure 9. Penalty analysis under competition.

Figure 10. Penalty analysis under probability overconfidence.

Figure 11 shows the optimal regulatory penalty under different values of ${\theta }_L$. The optimal penalty also increases as underestimation of breach losses becomes more severe. These results indicate that the regulatory penalty should not be treated as a fixed instrument. Effective correction requires the penalty to reflect both market conditions and the severity of managerial distortion.

Figure 11. Penalty analysis under loss underestimation.

Overall, this subsection further addresses RQ3 by showing that the corrective role of the breach-contingent regulatory penalty is bounded, and its design requires balancing underinvestment correction against firm payoff.

4.7. Joint Robustness Analysis

To further examine the robustness of the main results over a broader parameter space, we supplement the baseline simulations with a joint parameter-space exploration.

First, we jointly vary the breach-probability perception parameter ${\theta }_p$ and market competition $\Delta$, while holding all other parameters at their baseline values. Figure 12 presents the corresponding parameter-space pattern for preventive cybersecurity investment. The contour pattern shows that preventive cybersecurity investment increases with ${\theta }_p$. In Figure 12, each colored shaded region represents a range of $({\theta }_p,\Delta )$ combinations associated with a different level of preventive cybersecurity investment $I_p$. For example, the purple region corresponds to a relatively low investment level, around $I_p=5.3$, while the green and red regions correspond to higher investment levels, around $I_p=10.1$. As ${\theta }_p$ increases, the contour lines shift toward higher $I_p$ levels, indicating that preventive cybersecurity investment increases with weaker breach-probability overconfidence. More importantly, the dashed line in Figure 12 marks the threshold boundary at which the marginal effect of market competition on preventive cybersecurity investment changes sign. This boundary divides the parameter space into two regions. On one side, market competition promotes preventive cybersecurity investment. On the other side, the marginal effect of market competition becomes negative. Therefore, this boundary not only provides a direct visualization of the conditional nature of the competition effect, but also further indicates that the competition paradox identified earlier is not driven by a single baseline calibration and continues to exhibit a clear threshold boundary over a broader parameter space.

Figure 12. Preventive cybersecurity investment under breach-probability overconfidence and market competition.

Second, we jointly vary the breach-loss perception parameter ${\theta }_L$ and the breach-contingent regulatory penalty m, with all other parameters fixed at their baseline values. Figure 13 further indicates that the promoting effect of the regulatory penalty on preventive cybersecurity investment varies with ${\theta }_L$. In Figure 13, each colored shaded region represents a range of $({\theta }_L,m)$ combinations associated with a different level of preventive cybersecurity investment $I_p$. For example, the purple region corresponds to a relatively low investment level, around $I_p=4.86$, while the green and red regions correspond to higher investment levels, around $I_p=9.44$. As the regulatory penalty m increases, the contour lines shift toward higher $I_p$ levels, indicating that stronger breach-contingent penalties promote preventive cybersecurity investment. When ${\theta }_L$ is lower, this promoting effect is generally stronger. This suggests that the breach-contingent regulatory penalty remains effective under different degrees of breach-loss misperception.

Figure 13. Preventive cybersecurity investment under loss underestimation and regulatory penalty.

Overall, the joint analysis shows that the main qualitative results remain stable over a broader parameter space. Parameter interactions affect threshold locations and effect magnitudes, but they do not change the core mechanisms identified in the analytical model.

5. Managerial and Policy Implications

The analytical and numerical simulation results support three main managerial and policy implications.

First, corporates should reduce the influence of biased managerial beliefs on cybersecurity decision making. The model shows that breach-probability overconfidence mainly depresses preventive cybersecurity investment and, by weakening defense, increases the attacker’s incentive to increase attack effort. This implies that corporates should not rely excessively on subjective managerial judgment when allocating cybersecurity resources, but should instead place greater emphasis on objective assessment of breach likelihood. For corporates, the key issue is not simply whether cybersecurity spending is increased, but whether investment decisions are distorted by biased risk perception that systematically understates the need for prevention.

Second, when breach losses are underestimated, corporates should not treat remedial cybersecurity investment as secondary to preventive cybersecurity investment. The results show that underestimation of breach losses reduces both preventive cybersecurity investment and remedial cybersecurity investment. This means that such bias weakens not only prevention but also ex post recovery capacity. Accordingly, corporates should consider post-breach response capability together with ex ante prevention in cybersecurity investment decisions, rather than treating recovery as a separate or subordinate component. In other words, cybersecurity investment should be understood not only as a means of reducing the probability of breach, but also as a means of limiting residual loss after a breach occurs.

Third, regulators should not assume that market competition will always improve cybersecurity incentives. The model shows that when managerial bias is mild, competition can strengthen preventive cybersecurity investment, but when managerial bias becomes severe, competition may instead intensify underinvestment. This suggests that competitive pressure does not automatically translate into stronger cybersecurity incentives. In this setting, the model further shows that a breach-contingent regulatory penalty can mitigate underinvestment caused jointly by behavioral bias and competitive pressure, but its corrective effect is bounded. Although a higher penalty increases preventive cybersecurity investment, excessively high penalties also reduce corporate payoff. Therefore, from a policy perspective, the focus should not be on increasing penalties alone, but on setting the penalty in light of the competitive environment and the severity of managerial distortion, so as to balance corrective incentives against the burden imposed on corporates.

Overall, the results of this study suggest that corporate cybersecurity underinvestment is not driven solely by technical constraints or cost considerations. It may also arise from the interaction between biased managerial beliefs and the external competitive environment. Accordingly, both internal cybersecurity decision making and external regulatory design should pay closer attention to the joint role of behavioral distortion, market competition, and incentive design.

6. Conclusions and Future Research

6.1. Conclusions

This study examines corporate cybersecurity investment under managerial overconfidence, market competition, and regulatory penalty by developing a behavioral game-theoretic framework and conducting numerical simulations.

This study makes three main contributions. First, it distinguishes breach-probability overconfidence from underestimation of breach losses and shows that the two biases have asymmetric effects on preventive cybersecurity investment and remedial cybersecurity investment. Second, it identifies a conditional competition paradox: market competition strengthens preventive cybersecurity investment under mild managerial bias but weakens it when distorted threat perception becomes sufficiently strong. Third, it identifies the bounded corrective role of breach-contingent regulatory penalty. Such penalties can mitigate behaviorally induced underinvestment, but excessively high penalties reduce firm payoff.

6.2. Limitations and Future Research

This study has several limitations that should be considered when interpreting the results.

First, the current model assumes symmetric firms and uses a typical firm as the benchmark. These assumptions help identify the core mechanisms of the model, but they do not fully capture firm heterogeneity in real-world cybersecurity contexts. In practice, firms may differ in size, resources, risk exposure, governance capability, and cybersecurity readiness, which may lead to different investment responses under managerial overconfidence and market competition. Future research could incorporate heterogeneous firms into the analytical framework.

Second, the current model characterizes strategic attackers in a relatively simplified way and adopts a static two-stage framework. As a result, it does not fully capture heterogeneity in attacker types and attack modes, nor does it reflect repeated attacks, learning effects, or dynamic attacker–defender interactions. In particular, the assumption of a single profit-maximizing attacker substantially abstracts from the complexity of the real threat landscape and may affect the conclusions regarding the role of regulation and the boundary conditions of its effectiveness. In practice, attackers may differ in objectives, capabilities, persistence, and target selection logic, while firms may also adjust their strategies dynamically in response to past incidents and changing market conditions. Future research could extend the present framework by introducing heterogeneous attackers or dynamic interactions, and further examine the robustness of the regulatory conclusions under different threat structures.

Third, the current model treats the breach-contingent regulatory penalty as a deterministic parameter. This simplifying assumption helps identify the corrective role of regulation, but it does not fully capture the complexity of real-world regulatory environments. In practice, the actual penalty faced by a firm may depend on breach detection, enforcement intensity, legal context, regulatory discretion, and uncertainty in post-breach investigation and sanctioning. Future research could model regulatory penalty as probabilistic, state-dependent, or institutionally heterogeneous.

Accordingly, the analytical and policy conclusions of this paper should be understood as benchmark, mechanism-based, and directional, rather than as one-to-one predictions for all real-world cybersecurity settings.