This project asks whether addressing software vulnerabilities or misconfiguration should be higher priority when pursuing Secure by Design. Here, vulnerabilities are flaws introduced by the vendor, in contrast to configuration which is controlled by the end-user.

Workshop on the Economics of Information Security (WEIS'25) venue and dates just announced. Date: June 23-25, 2025 Venue: Institute of Industrial Science (IIS), The University of Tokyo kmlabcw.iis.u-tokyo.ac.jp/weis/2025/in...

Initial access vectors according to various DFIR firms. Random thoughts: - None of the reports find the majority are caused by vulns/exploits - How do some of these firms *not* have an "unknown" category - Many categories are overlapping - We really need a standardized schema @zakird.com

I've started building a starter pack for security economics researchers. It's a work in progress, so feedback and suggestions are more than welcome! We'll continue to update it—stay tuned! go.bsky.app/BgGNPep

fun fact from SEC Chairman Gary Gensler's resignation announcement 18% of tips/complaints that come to the SEC relate to crypto, even though the crypto market is less than 1% of all financial markets www.sec.gov/newsroom/pre...

What does personal cyber insurance cover? Our new article found that personal cyber insurance covers a range of online harms, including social media abuse. "Why would money protect me from cyber bullying?": A Mixed-Methods Study of Personal Cyber Insurance www.computer.org/csdl/proceed...

Very proud of Lawrence (Yangheran) Piao who had his first article accepted at Oakland'25. The paper looks at the role of hacker teams in the Chinese bug bounty ecosystem. We very sadly lost Ross Anderson mid way through this project. www.computer.org/csdl/proceed...

I enjoyed Tyler Cowen and Alex Tabarrok on insurance, especially reflections on where the good insurance scholarship is. No surprise that the sociologists were more insightful than the economists. marginalrevolution.com/marginalrevo...

Most people outside of research are still unaware of how much the cyberattack on @britishlibrary.bsky.social is still affecting the research community one year on. Good piece covering that + need to invest in libraries www.timeshighereducation.com/depth/how-br... @timeshighered.bsky.social

Still love this service we started way back when (2020 I think), & very proud that it’s now got over 35 million reports! If you get a suspicious email then send it to [email protected]

Just made the jump. I research riveting topics like: - Cyber insurance - Cyber risk quantification - Incident response - Online tracking I'm interested in understanding economic incentives and historical development using quantitative and qualitative methods.