Interesting article discussing cyber-warranties, and if they are a good way to transfer risk (as envisioned by Ackerlof’s “market for lemons”) or perhaps a marketing trick.
The conclusion:
Warranties should transfer non-negligible levels of liability to suppliers to be able to meaningfully overcome the marketplace for lemons. Our preliminary evaluation suggests nearly all cyber warranties protect the price of repairing these devices alone. Just cyber-incident warranties include first-party expenses from cyber-episodes — why all this kind of warranties were provided by companies selling intangible products can be an open question. Customers should issue whether warranties can work as an expensive signal when narrow insurance coverage means vendors accept small risk.
Worse nevertheless, buyers cannot evaluate across cyber-incident warranty agreements because of the diversity of obligations and exclusions. Ambiguous definitions of the buyer’s obligations and excluded activities create uncertainty over what’s covered. Relocating toward standardized conditions and terms may help customers, as has already been pursued in cyber insurance policy, but that is in tension with advancement and item diversity.
[..]
Theoretical work suggests both breadth of the warranty and the price tag on a product determine if the warranty functions as an excellent signal. Our analysis have not touched upon the cost of these products. Maybe firms with ineffective items pass the expense of the warranty to buyers via increased prices. Future research could evaluate warranties and price collectively to probe this matter.
In bottom line, cyber warranties — particularly cyber-product warranties — usually do not transfer sufficient risk to become a market fix since imagined within Woods. But this will not mean they’re pure marketing techniques either. Probably the most valuable function of warranties will be in preventing suppliers from exaggerating what their items can perform. Consumers who browse the small print can place better rely upon marketing claims as long as the efficiency is included in a cyber-incident guarantee.
