On market concentration and cybersecurity risk

1. Introduction

Trends towards market concentrations are the new normal in IT systems, on the Internet, and across the World Wide Web. Concentration is often the cumulative result of myriad small, independent, and freely taken choices, though the deliberate acts of organisations to absorb competition ought not be minimised. Online, mechanisms of preferential attachment often dominate (Barabási and Albert Citation1999; Barabási Citation2014; Jardine Citation2017a). People tend to frequent online shops, services, and software that is already widely used. Everybody uses Facebook, Microsoft, Apple, Tik Tok, Snapchat, Whatsapp or Google, to name a few, because everyone else uses these same services. In many instances, the reward for interconnection, as famously dictated by Metcalfe’s Law, is proportional to the number of possible two-way connections, that is, proportional to the number of nodes squared (Metcalfe Citation1995; Metcalfe Citation2013; Zhang, Liu, and Xu Citation2015). The implication is that the greatest user and corporate value is often found at the most frequented places.

The cumulative result of numerous independent choices is a space with extraordinarily big platforms, systems and providers. The examples of such points of concentration range across operating systems (e.g. Microsoft Windows; Apple OS), protocols (e.g. WPA2; WiFi), e-commerce sites (e.g. Amazon; Alibaba), social networking sites (e.g. Facebook; Twitter), content delivery networks (e.g. Akamai; Cloudflare), cloud computing services (e.g. AWS; Azure), antivirus vendors (e.g. Symantec; ESET), aggregation platforms (e.g. Reddit), and so forth.

This tendency towards market concentration has a number of effects on systemic cyber risk, many of which mirror similar concentration risk effects in other sectors of the economy and society (Gürtler, Hibbeln, and Vöhringer Citation2010; Mandelbrot Citation2013; Zhang et al. Citation2013; Dhaliwal et al. Citation2016). These effects play out at every level of the cyber risk equation, that is, across threat, vulnerability and impact. While in no way exhaustive of the complexity in this domain, this paper details three theses on the relationship between concentration and cyber risk.

Overall, these three theses suggest that market concentration tends to have both redistributive and accentuating effects on cyber risk. Market concentration, broadly defined, tends to shift the risk of being attacked from individuals and minor nodes towards major players. Market concentration can also exacerbate systemic vulnerability and significantly increase the odds of high impact, system-wide failure. Dealing with cyber risk requires dealing with market concentration.

To make our case, the article unfolds this way: The following sections first detail the cyber risk (i.e. threat, vulnerability and impact) equation and define our conceptualisation of market concentration. Extending that line of argument, each section plots the interaction of patterns of market concentration and a discrete part of cyber risk, showing in detail and with illustrative examples how the former influences the latter. We conclude with policy suggestions for mitigating cyber risk in highly concentrated systems.

2. Defining cyber risk and market concentration

Cyber risk, like risk in any adversarial space more generally, is a function of threat, vulnerability and impact (Cox Citation2008; Hubbard and Seiersen Citation2016; Coburn, Leverett, and Woo Citation2019). The threat component of the equation is the probability that an organisation will be targeted by malicious activity. It can range from 0 per cent, not attacked, to 100 per cent, definitely attacked in a given period. The vulnerability component of the cyber risk equation captures what happens if an organisation is targeted by a malicious actor. Some intrusion attempts will fail. Others will succeed. The vulnerability component captures this variance by assigning a probability that a targeted organisation can mount a successful defence, given both the competence of the attacker and the skills of the defender. This component, too, ranges from 0 per cent to 100 per cent, i.e. always fails at security to always succeeds. The final component of the formula is impact, which denotes the dollars, hours of downtime, or some other measure of fallout from a malicious attack. Multiplied together, the three components provide a sense of an organisation’s level of cyber risk over a given period.

Formally, the scope of market concentration in an ecosystem can be measured by the Herfindahl-Hirschman Index (HHI). The HHI is measured as the sum of the square of each organisation’s market share. The result of this mathematical process is a number ranging from 1 to 10,000, with perfect monopoly at 10,000 and a perfectly competitive system at an HHI value of 1 (Hirschman Citation1964; Hirschman Citation1980; Rhoades Citation1993). In practice, markets with an HHI above 2,500 are considered very concentrated.

More amorphously than a precise HHI number for each sector of the economy and Internet, concentration for our purposes can take several forms. Market concentration is about size, scale, centralisation and interconnectedness. It is, in the broadest terms, the amount of records, dollars, users, decision-making prerogative or degree centrality (incoming/outgoing links) a platform, provider, protocol, code base or organisation has when compared to the sum of all other like entities. Concentration can unfold along geographical space, time and name space. Systems with high levels of market concentration have, relative to the rest of the participants in that area of activity, big companies, big platforms, big providers, big intermediaries, big everything. Framed differently, concentrated organisations, platforms, or protocols have lots of links, customers, users or clients. Concentrated systems are ones where the choices of a big few affect the outcomes of the many. Concentrated systems can also be viewed as the opposite of diverse systems, meaning their component parts are more similar than not. Concentrated code bases, for instance, can be marked by something as simple as the proportion of used software written in the same programming language, e.g. Cobalt, anyone?

Concentration has several benefits economically. For example, firms plausibly emerge at all in order to contend with market-based transaction costs (Coase Citation2012). Bigger firms can also leverage their size to capture increasing return to scale and scope, improve their efficiency through greater task specialisation, and make longer term investments that maximise their revenue and profit growth. Too much scale, centralisation and concentration, of course, can each produce their own set of economic disadvantages, but there are clear economic reasons why organisations tend to get bigger, centralise their decision-making, and expand their proverbial footprints.

Yet concentration, as we detail in depth in the following sections, can also result in security/cyber risk consequences. Table 1 presents a non-exhaustive set of examples of the types of concentration we have in mind when we use the phrase, ‘market concentration’. Table 1 also details: (1) the reason it might be economically rational to concentrate and (2) some of the security consequences that can emerge from each type of concentration when viewed from an attacker’s perspective.

Table 1 is meant to highlight some of the diversity of possible cases that could be included under a comprehensive analysis of the interrelationships between market concentration and cyber risk. Our analysis below draws upon different cases that exemplify certain patterns and trends. We selected the cases largely for their data richness. They are not systematic, but are indicative of what the general theses in each section suggest we ought to observe (King, Keohane, and Verba Citation1994). In other words, the cases do not suggest that concentration always produces the detailed effects on security, only that the logic is there and some supportive evidence can be readily found.

Next, we detail how concentration interacts discretely with each component of the cyber risk equation and generally across all three component parts. These interactions affect both the distribution of risk and its amount of risk present in the system.

3. Thesis 1: market concentration and threat

Given a set of attack interests, capabilities and capacities, the threat component of the risk equation is about who gets attacked in the first place. More formally, and from the defender’s perspective, it is the probability that a malicious actor will expend the resources and time to try and compromise a given target’s systems. Threat matters because an organisation can be said to have zero current risk from malicious actors if it is never attacked. Of course, zero past risk only correlates with, and does not determine, future risk.

Not all organisations or individuals are equally likely to be targeted by malicious attacks, and some attacks are opportunistic rather than targeted (or rather they target a technology such as default SSH credentials, instead of an organisation or individual). Certainly, some famous cyber intrusions are simple attacks of convenience. Equifax’s failure to patch Apache Struts in 2017 created an easy way in for whoever compromised the system, suggesting more of an attack of opportunity than intent per se, though revelations of potential Chinese state involvement complicate the previously known story (Newman Citation2017). Other attacks, such as those that targeted the Democratic National Committee before the 2016 election, are highly deliberate, targeted and persistent.

Concentration directly affects the threat component of the risk equation by changing the malicious actor’s opportunity space. Concentration, in this sense, has predominately distributional effects on the threat component of cyber risk, namely, concentration leads to risk transference. Who gets targeted is a function of potential reward for malicious actors, which is, in turn, a function of a potential target’s size or network centrality. Increased size and position correlate with malicious actor payout, whether that reward is financial, disruptive or geopolitical.

As a market concentrates, the risk of being targeted by a cyberattack transfers from small, less central organisations to the major hubs or their counterparties (e.g. the Target Breach). For smaller organisations that might not be able to assume the financial cost of greater levels of cybersecurity, the transference of risk from small to big organisations would be a blessing. From the perspective of the highly concentrated organisations, the increased volume of attacks that need to be dealt with impose additional operating costs. In the Internet economy, being a major hub is often necessary for profitability (Jardine Citation2017a), but it also means that your platform will act like a magnet for malicious activity.

The history of malware targeting personal computer operating systems exemplifies this process of risk transference. For years, Windows OS was heavily targeted by malware designers. Mac OS, in contrast, maintained a mythology of a malware free system. This initial state of affairs, however, was not necessarily just a function of Macs having better OS security; divergent malware development rates for the two platforms is well explained by simple economic incentives.

Malicious actors should want to attack points with the highest reward ratio. And indeed, a formal model shows that market share drives malware development markets. Assuming equal levels of OS vulnerability, malware designers will target only the OS with the largest market share when the ratio of the dominant OS to the next largest OS is greater than the protection potential of the dominant OS overall (O'Donnell Citation2008). This formal model suggests that rational malicious actors would not even waste time designing malware to target Mac OS until it accounted for at least one-sixth of the OS market. Other formal models show similar trends in the concentration of malicious actor activity on dominant platforms (Arce Citation2018). In risk-based terms, the concentration of users on Windows OS for much of the history of personal computing had a redistributive effect on the threat component of risk. It transferred the risk of being targeted by malicious actors in the first place from Mac and Linux OS users to those who used Windows.

These earlier trends have had a legacy effect on risk among software platforms, making Windows still a more targeted system than alternative operating systems. But the final point that this example illustrates is more general: points of concentration promise the most reward and will be targeted the most frequently. Users of secondary systems, platforms or services might give up some benefits in terms of coordinated efficiency or positive network externalities, but might also reduce their cyber risk.

4. Thesis 2: concentration and vulnerability

The vulnerability component of cyber risk captures the expected/realized outcome of an attack on an organisation. It is a simple truism that attempted attacks sometimes succeed and sometimes fail. Attacks vary considerably in their sophistication and persistence. Organisational defenses, both technical and human, similarly vary, ranging from thorough to haphazard. Together, the interaction of the sophistication of the attacker, the defensive profile of the organisation, and a dose of luck produces some volume of successful and failed intrusions. In cyber risk terms, each organisation assuming they are attacked in the first place has a probability of being compromised over a given period. At the extremes, well-defended networks faced with unsophisticated attackers are likely to remain secure, while poorly defended networks faced off against competent and persistent opponents are likely to be breached.

Concentration affects the vulnerability component of the cyber risk equation. Three distinct effects emerge, each of which is unpacked more below. First, concentration in large providers can lead to an average reduction in the individual vulnerability of users, website operators and organisations due to the often greater security services provided by these major hubs. Second, since concentrated nodes tend to get targeted more often, joint probabilities suggest that they might be vulnerable across a large enough sequence of attacks. Third, platform and service concentration can also lead to increases in complexity, which can have negative effects at the level of software, increasing the proportion of vulnerable code and worsening time-to-patch rates, leaving more systems vulnerable for longer windows of time. The first effect suggests that individuals can leverage scale to reduce their risk. The second and third suggest that at a systemic level, concentration can increase vulnerability and worsen cyber risk.

5. Concentration and impact

If targeted and then compromised, what happens next (i.e. the fallout or impact of a cyberattack) is hugely variable, but likewise dependent on patterns of concentration, among other factors. One way to conceptualise concentration and scale is to think of big organisations as being highly connected, in the sense that what happens to the big organisations ripples out and affects many others. A diffuse system is one with isolated pockets, without, in network theory terms, connecting edges to other nodes. In highly concentrated systems, everything is connected, especially to the big nodes (e.g. organisations or platforms) in the system. Such interconnections can take a number of forms, but readily include links between organisations via data sharing agreements, common supply chains and third party vendors. Interconnections create transmission pathways by which the negative consequences of a security incident can percolate through a whole system (Geer Citation2018a).

Content delivery networks (CDNs) are a good example of how a cluster of users on a single service can amplify the potential impact of major security incidents. CDNs move content closer to the edge nodes of the network and allow users to both get better service quality and improved protections from distributed denial of service (DDoS) attacks. Because CDNs can leverage resources in a coordinated way, they tend to be more efficient than a loosely interlinked group of, say, individual website operators who are all providing their own bandwidth to handle incoming traffic. That efficiency means that there are fewer system-wide resources to handle big malicious events than would otherwise be the case, but the CDN can leverage the available resource in a more coordinated way, bringing more capacity to bear at any given point in time.Footnote ¹ Effectively, CDNs, like AV vendors before, can sometimes reduce individual user vulnerability by leveraging their increased scale in a coordinated way.

But when the CDN or other major Internet node fails, the effect of concentration on the impact element of the cyber risk equation can be large indeed. Take the 2016 attack on Dyn, a domain name system provider, as an example. The attack was well into the terabyte per second range (the largest attack to date is a 1.3 tbs attack on Github), but still represents only around one-hundredth of the latent DDoS potential worldwide (Leverett and Kaplan Citation2017). The attack temporarily disrupted the services of some 69 different Internet-based companies, ranging from AirBnB to Zillow, but including such big named brands as Netflix, Spotify, HBO, Fox News and Twitter. Cumulatively, the economic cost of the attack was huge. (The more interconnected, the more counterparty risk matters.)

The root of the problem in the Dyn case was that these companies all used Dyn’s services to resolve their DNS queries (this example showcases concentration in name space, since the DNS itself is a distributed protocol and Dyn, to a lesser degree, maintains a geographically distributed infrastructure). When this concentrated Goliath fell, the ripple effects were large indeed. Consider for a moment the counterfactual, where each company maintains its own DNS services. The system would be far less efficient and less able to handle major traffic requests. Yet when one point in the system failed, the scope of the potential damage or disruption (impact, to use the cyber risk term) would be minimal. AirBnb might fall for a period if hit by a 1.3 tbs attack, but this would not influence the provision of service by Spotify, HBO or any other online services. Decentralisation, as opposed to concentration, can limit the potential impact that any given cyber attack might have by precluding common-mode failure.

Lest we be fooled, the adverse effects of market concentration on the impact component of cyber risk are not confined to online services. Operating systems are another clear example. Microsoft is the dominant OS used in most PCs attached to personal and government networks. When a new zero day for Microsoft hits the wild, the effects can be large. The WannaCry attack in May 2017 is one such example. The malware made use of the Eternal Blue exploit, which was reportedly found by the National Security Agency (NSA), leaked online by the Shadow Brokers, and then used by some unknown party to launch a globe-spanning ransomware attack.

The exploit targeted systems running an unpatched version of Microsoft 7, 8 and XP. Over the span of a weekend, the attack spread to well over a hundred countries and affected some 200,000 devices, with the National Health Services in the United Kingdom getting hit particularly badly. The attack was aborted early by the actions of a single computer enthusiast/hacker named Marcus Hitchens, who accidently stopped the attack by registering the domain name kill switch, preventing its further spread (Solon Citation2017). WannaCry’s spread in response to a single exploit once again highlights the potential effects of market concentration on the impact component of cyber risk. When everyone is on the same system, not only does that system attract the bulk of malicious attacks, making it likely to fail over a large enough volume of attacks, but the potential impact of a successful attack moves from a private tragedy to a system-wide, cascading and potentially significant event.

Indeed, the problems of scale and interconnection are not as idiosyncratic as these examples might suggest. More systematic evidence suggests that (a) security events that come to involve multiple parties are disproportionally costly compared to single organisation events; and (b) larger organisational size tends to generate more pronounced downstream ripple effects, suggesting that the more big organisations there are in a sector, the more that knock-on effects ought to be expected (Riskrecon and Cyentia Institute Citation2019). The median cost of a breach of a single organisation is $77,200, with no downstream or upstream ripple effects. The median cost of a multiparty event is $999,500. On a frequency distribution, the extreme end cost (95%) for a single organisation is $16,000,000, while the same 95 per cent event involving multiple organisations through downstream and upstream interconnections is $417,362,204 (Riskrecon and Cyentia Institute Citation2019). The compromise of multiple organisations should obviously cost more than the breach of a single firm, but the cost of ripple effects due to interconnection is out of proportion with the number of total victims. The ratio of downstream to originating organisations affected by a security incident in a multiparty breach is 8-to-1. The ratio of median costs for a single vs multiple party incident, however, is 13-to-1 (Riskrecon and Cyentia Institute Citation2019).

Big nodes measured by companies with more employees in this case also create bigger downstream ripple effects. An ecosystem with many big organisations is, therefore, likely to suffer from far more and far costlier security incidents as the effects ripple out across the various interconnected links, spreading from a central organisation to third party vendors, downstream clients and so forth. For example, while companies of every size as measured by the number of employees can cause a multiparty security incident, larger firms are more often the source of a multiparty security event, while small-to-medium sized enterprises are usually the recipients of such events, as detailed in Figure 4 (Riskrecon and Cyentia Institute Citation2019).

Concentration, in other words, negatively affects the impact component of the cyber risk equation. Bigger organisations or platforms have lots of users who can all be simultaneously affected by a security incident. Bigger organisations also tend to be more interconnected with others via supply chains, third party vendors and other service providers. In either case, concentration to the extent that it denotes greater scale and interconnection tends to create the scene for a disproportionately pronounced fallout from a security incident.

6. Contending with cyber risk in highly concentrated markets

Concentration influences all three components of the cyber risk equation: threat, vulnerability and impact. It plausibly causes a redistribution of risk that affects the threat component, shifting attacks from infrequently used nodes towards the larger hubs of activity. It also plausibly improves individual security outcomes in the median case by transferring the work of security from individuals to large hubs with advantages of professionalism and scale. These hubs can leverage their scale to produce more security but are at risk of being undone by being targeted so much that even their improved protections are simply overwhelmed. Lastly, larger hubs increase the odds of significant failures, worsening the potential negative outcome of a cyberattack.

The cumulative result of this analysis is fairly simple. Many forms of market concentration, from protocols and code to links, users, services, firms or platforms, both shifts and aggravates cyber risk. If that is the case, then the issue of cyber risk becomes an increasingly relevant concern as more of society’s functions transition to online-only. If the Internet does eventually become, as former Swedish Prime Minister Carl Bildt put it, ‘the infrastructure of all other infrastructures’, then trends in market concentration present some very real, society-wide cybersecurity challenges (Bildt Citation2015).

Norm building efforts aimed at preventing malicious use of the Internet and IT systems in the first place can help manage risk (Governance Citation2015; Bildt and Smith Citation2016; Cyberspace Citation2019). More precisely to the issue of concentration, remedial steps, at their core, advance along four lines:

First, cyber risk can be managed only to the extent that it can be measured. Models of managing cyber risk at the level of an individual firm suggest that expenditure should not exceed 37 per cent of the expected costs of a security incident (Gordon and Loeb Citation2002; Gordon and Loeb Citation2006; Baryshnikov Citation2012; Geer Citation2015; Gordon et al. Citation2015). Yet, accurately measuring cybersecurity events is hugely challenging, as measures often suffer from problems of the denominator (Jardine Citation2015, Citation2018, Citation2020), incompatible metrics (Brecht and Nowey Citation2013), insufficient attention to over time trends (Geer and Jardine Citation2017; Jardine Citation2020), measures distorted by political or economic incentives (Anderson et al. Citation2008; Anderson et al. Citation2013; Lawson and Middleton Citation2019), a lack of data transparency necessitating clever measurement techniques (Woods, Moore, and Simpson Citation2019), reporting biases (Florêncio and Herley Citation2011) and data aggregation problems (Jardine Citation2017b; Jardine Citation2020). Issues of technological flux likewise present a challenge where past data might supremely fail to predict future events. The task of producing better measures is not easy, but it is fundamental. Good risk mitigation policies require a concerted effort to better measure every aspect of the Internet ecosystem in a way that at least allows for the potential for data-driven policy.

Second, countering growing cyber risk that arises from trends toward greater market concentration requires the deliberate development of ecosystem diversity, even though such a process often runs afoul of the sound economic logic pushing towards greater scale and centralisation (Coase Citation2012; Geer Citation2018a). Redundant systems in large clusters are not sufficient. Redundancies understood as more of the same will not help protect against the cyber risks that follow from greater market concentration. Ten thousand redundant systems all running Microsoft Windows or Apache Struts can fall like dominos when these systems are compromised. Like in nature, diversity can increase resiliency and prevent cascading failures. Diversity of systems might introduce inefficiencies that hurt the bottom line, but they protect against costly large-scale failures. Promoting diversity, especially for critical services, is likely key if cyber risk is to avoid reaching or potentially pull back from a level where an Internet-equivalent of an extinction event is possible. Concrete methods for promoting diversity of systems could range from anti-trust legislation in an extreme to tooling government or corporate procurement of IT technologies and services to prevent homogeneity of providers/platforms.

Third, calculations of cyber risk insurance need to factor in ecosystem-wide trends in market concentration in order to accurately price risk, especially to the extent that cyber risk exhibits features that are distinct from other risk types (Biener, Eling, and Wirfs Citation2015). While organisational factors (such as corporate revenue and assets) are a common feature of cyber risk insurance policies (Romanosky et al. Citation2019), each firm remains nested in an sector with distinct patterns of market concentration. The way in which proportional organisational size interacts with malicious actor incentives suggests that accurate insurance pricing requires knowing not just how big in absolute terms a prospective policyholder might be, but also how large of a share of the ecosystem (sector/industry) they represent. In highly concentrated spaces, premiums for the main nodes should be disproportionately high and payments for others comparatively low, everything else being equal. In more competitive markets, premiums weighted for asset value and organisational security procedures should trend towards a median value. Yet, issues such as the over-supply of insurers can inhibit effective security governance through insurance pricing mechanisms (Woods and Moore Citation2019; Woods, Moore, and Simpson Citation2019).

Fourth, for certain systems, measurement to manage risk and diversity might be insufficient and persistent disconnectedness might be needed (Geer Citation2018a). Interconnection in many aspects of life may increase risk, yet do so within manageable bounds. Certain aspects of a country’s critical national infrastructure, however, is likely too important to interconnect, even if such connection is done with the best security standards in mind. The implication, really, is that high impact events that affect many due interconnection and concentration might be limited via disconnected firebreaks. Senate Bill 79, which was recently included in the National Defense Authorization Act, proposes just such a move in the United States with regards to US energy infrastructure. To mitigate risk, certain parts of a nation’s infrastructure might be best left off the proverbial table.

7. Conclusion

In sum, there is an often malign association between trends in market concentration and the location and level of cyber risk within the system. Much of these patterns are not unique to cyberspace and could affect other facets of risk in finance and other sectors. Market concentration affects all three elements of the cyber risk equation, as it does to a degree in a host of other sectors, but particularly the financial sector (Gürtler, Hibbeln, and Vöhringer Citation2010; Taleb Citation2010; Mandelbrot Citation2013; Zhang et al. Citation2013; Kasman and Kasman Citation2015; Dhaliwal et al. Citation2016). Via the threat component, trends in market concentration redistribute risk, changing who gets targeted by a malicious actor in the first place. Everything else being equal, attackers tend to target the concentrated hubs because that is where the biggest reward resides. Via the vulnerability component, shifting market concentration levels can both reduce individual risk to a degree, but also increase systemic vulnerability because big services (players) are targeted so much that they eventually fail and larger organisations also exhibit the worst time-to-patch rates, leaving them and their users vulnerable for longer. Finally, via the impact component of the risk equation, concentrated nodes can mask unseen interdependencies that can give rise to massive, cascading failures.

Imagine a hypothetical example of perfect market concentration. All users cluster onto one platform. All attacks flow at that platform. Eventually that platform fails, and all users are compromised. This extreme example is a difference in degree, rather than a difference in kind, from the events that unfold due to current trends in market concentration. The implication is that countering trends in market concentration, a process that means at one level dealing with how people freely choose to use services and platforms (Barabási and Albert Citation1999; Barabási Citation2014; Jardine Citation2017a), is essential for managing cyber risk on the Internet. Conversely, attempting to deal with cyber risk without also contending with trends in market concentration are likely to fail.