Cybersecurity has gained prominence in the decision-making of firms. Due to the increasing occurrences of threats in the cyberspace, investments in cybersecurity have become critical to mitigate the operational disruption of businesses. This paper surveys the theoretical literature on the firms' incentives to invest in cybersecurity. A taxonomy of the existing contributions is provided to frame them in a common reference scheme and a model is developed to encompass such contributions and discuss their main findings. Papers that investigate the investment problem of an isolated firm are distinguished from those that consider interdependent firms. In turn, interdependent cybersecurity is analyzed in three different contexts: (i) firms that operate their business via a common computer network, but are not competitors in the product market; (ii) firms that are competitors in the product market, but run their business using non-interconnected computer systems; (iii) firms that are competitors and rely on a common computer network. Finally, promising avenues for future research and policy implications are discussed.

中文翻译：

---

危险游戏：网络安全投资文献综述

网络安全在公司的决策中变得越来越重要。由于网络空间中越来越多的威胁发生，对网络安全的投资对于减轻企业的运营中断至关重要。本文调查了有关公司投资于网络安全的动机的理论文献。提供了现有贡献的分类以将它们构建在一个共同的参考方案中，并开发了一个模型来包含这些贡献并讨论它们的主要发现。研究孤立公司的投资问题的论文与那些考虑相互依赖的公司的论文不同。反过来，在三个不同的背景下分析相互依赖的网络安全：（i）通过通用计算机网络开展业务但在产品市场上不是竞争对手的公司；(ii) 产品市场上的竞争对手，但使用非互连计算机系统开展业务的公司；(iii) 作为竞争对手并依赖于共同计算机网络的公司。最后，讨论了未来研究和政策影响的有希望的途径。