Information Disclosure and Security Vulnerability Awareness: A Large-Scale Randomized Field Experiment in Pan-Asia

Abstract

This paper investigates how the disclosure of a security vulnerability index based on outgoing spams and phishing website hosting, which may serve as an indicator of a firm's inadequate security controls, affects companies' security protection strategy. Our core objective is to study whether firms improve their security when they become aware of their vulnerabilities and such information is publicized. To achieve this goal, we conduct a randomized field experiment on 1,262 firms in six Pan-Asian countries and regions. For the treatment group of 631 firms, we alert them of their security vulnerability index and ranking over time, and their relative performance compared to their peers via emails and a public advisory website. Compared with the control group without being informed of their security vulnerability index, the treatment group improved their security over time, with a significant reduction of outgoing spam volume. A marginally significant improvement in reducing phishing hosting websites is also observed among non-web hosting firms in the treatment group. The security improvement may be attributed to firms' proactive reaction to the security vulnerability information. Our study provides cybersecurity policy makers with useful insights on how to motivate firms to adopt better security measures.