Competitive and Strategic Effects in the Timing of Patch Release

Arora, A and Forman, C and Nandkumar, A and Telang, R (2005) Competitive and Strategic Effects in the Timing of Patch Release. In: Workshop on the Economics of Information Security, England.

Full text not available from this repository. (Request a copy)


The relationship between quality and market concentration has long been of interest to both policy makers and economists. In our application, we focus on the effect of competition on one aspect of software quality – time taken by software vendors to release patches that fix vulnerabilities. We empirically estimate how the extent of competition affects the timing of patch release using a novel dataset assembled for the purposes of this research. Competition in the context of information security has two separate effects: First is the disclosure threat effect - the possibility of any of the other vendors that are also affected by the same vulnerability, releasing patch earlier, thereby implicitly disclosing the vulnerability. Second is the competition effect, which is the effect of end users penalizing laggards, by comparing responses of vendors that also sell a similar product. Our results suggest disclosure threat hastens the arrival of a patch by about 24 days, whereas competition effect hastens patch release by 52 days on average. Further, firms with larger sales (of the product) patch faster: a 10% increase in firm sales is associated with an earlier patch release by about 2.5 days. Therefore, our results support the notion that greater competition results in better ex-post service quality. Further, to the extent that earlier patch release minimizes consumer loss, our results suggest that when higher number vendors are affected by the same vulnerability end user losses are lower, thereby leading to better social outcomes.

Item Type: Conference or Workshop Item (Paper)
Additional Information: The research paper was published by the author with the affiliation of Carnegie Mellon University
Subjects: Business Strategy
Date Deposited: 09 Aug 2023 09:35
Last Modified: 09 Aug 2023 09:36

Actions (login required)

View Item
View Item