Competitive and Strategic Effects in the Timing of Patch Release

The relationship between quality and market concentration has long been of interest to both policy makers and economists. In our application, we focus on the effect of competition on one aspect of software quality – time taken by software vendors to release patches that fix vulnerabilities. We empirically estimate how the extent of competition affects the timing of patch release using a novel dataset assembled for the purposes of this research. Competition in the context of information security has two separate effects: First is the disclosure threat effect - the possibility of any of the other vendors that are also affected by the same vulnerability, releasing patch earlier, thereby implicitly disclosing the vulnerability. Second is the competition effect, which is the effect of end users penalizing laggards, by comparing responses of vendors that also sell a similar product. Our results suggest disclosure threat hastens the arrival of a patch by about 24 days, whereas competition effect hastens patch release by 52 days on average. Further, firms with larger sales (of the product) patch faster: a 10% increase in firm sales is associated with an earlier patch release by about 2.5 days. Therefore, our results support the notion that greater competition results in better ex-post service quality. Further, to the extent that earlier patch release minimizes consumer loss, our results suggest that when higher number vendors are affected by the same vulnerability end user losses are lower, thereby leading to better social outcomes.