This paper investigates the interplay between interoperability and the incentives to invest in cybersecurity in digital markets. We develop a two-sided symmetric duopoly model in which cyberattacks create a congestion-like externality, and interoperability amplifies hackers' incentives to target connected platforms. We show that interoperability affects cybersecurity investment through multiple channels, potentially producing a non-monotonic relationship: Low interoperability promotes risk-mitigation efforts, whereas high interoperability may discourage investment due to a public good effect. We then compare private and social incentives to adopt interoperability, identifying potential sources of misalignment. Finally, we extend the baseline model to account for additional factors shaping the desirability of interoperability, including platforms' business models, users' awareness of cyber risk, asymmetries in user bases, and the role of alternative compensation schemes.

This paper investigates how cyberattacks affect the market valuation of European financial institutions. Using an event study methodology on a sample of 31 cyber incidents affecting European financial firms between 2016 and 2024, we document a clear and statistically significant negative market reaction concentrated on the announcement day. Importantly, we find no evidence of abnormal price movements prior to disclosure, which is inconsistent with systematic insider trading. In contrast to prior studies that report pre-announcement abnormal returns (ARs) around cyber incident disclosures, our findings suggest that information leakages and insider trading may be less of a concern in the European financial sector. A time-trend analysis reveals diverging patterns: while the impact of non-confidential attacks has intensified, the market response to confidentiality breaches has weakened, consistent with improved disclosure and crisis management practices.

Cyber risk has emerged as a critical challenge for businesses, governments, and individuals. The greater availability of data, the increasing dependence on digital infrastructures, and the ever-advancing level of sophistication of cybercriminals have intensified both the occurrence and impact of security breaches. Literature on the economic aspects of cybersecurity originates from several distinct research areas and employs various approaches, emphasising the multifaceted nature of this phenomenon. This survey presents an overview of the economic dimension of cybersecurity, summarising the main findings of this rich and interdisciplinary literature. Our survey focuses on the four key actors involved in cybersecurity: hackers, companies, consumers/users and regulators. We provide an overview of the motivations and strategies employed by hackers, examine how companies and users protect themselves against cyber risks and respond to breaches, and analyse the economic and financial consequences. We also discuss the policy instruments available to regulators to mitigate both the likelihood and the impact of cyberattacks. In the final section, we suggest some potential directions for future research.

We study a platform's incentives to remove IP-infringing products and the effects of holding the platform liable for such infringements on innovation and welfare. We first show that platform liability can lead to either higher or lower commission rates, depending on how screening affects transaction volume. We then show that liability may spur or hinder innovation, depending on the intensity of cross-group network externalities.  A sufficient condition for platform liability to reduce total welfare is that it lowers innovation, in which case all market participants--the platform, innovators, imitators, and buyers---are worse off. We also provide a sufficient condition under which platform liability raises total welfare. 

Using administrative data on phishing attacks targeting almost 150,000 Italian- and German-speaking customers of an Italian bank in 2022–23, we investigate how individual characteristics are associated to the likelihood of victimization. We find that younger customers and Italian speakers are more likely to be victims of phishing, while we find no differences in terms of gender or size of the place of residence.

Time-inconsistent internet users neglect future privacy costs and release too much data to digital firms. We study how regulation that requires user consent for data processing affects firm profits, user surplus, and welfare, depending on the degree of time inconsistency and on firms' business models. If the firm appropriates sufficiently high profits from data, consent mechanisms increase welfare only if their design facilitates consent refusal and time inconsistency is neither too high nor too low. If firms can make it difficult to opt out, it may be better for society to let the former choose the disclosure level. However, consent policies increase user surplus when time inconsistency is high. Voluntary caps on usage can raise profits by making some users disclose more data.