Cloud Services vs. On-Premises Software: Competition Under Security Risk and Product Customization

Because of its on-demand feature and flexible pay-as-you-go mechanism, cloud service dramatically reduces the up-front information technology expenses that may deter many clients from implementing on-premises software. The associated security risks and low customization capability, however, create challenges for the adoption of cloud service. We study the competitive implications of security risks and customization capability on consumer purchase choices and vendors’ pricing and investment strategies. Although cloud services are perceived to be more vulnerable to cyberattack, our results demonstrate that in high-security-loss environments, using cloud service yields a lower average expected loss for consumers as compared with on-premises software. By endogenizing vendors’ investment decisions, our investigation highlights that the cloud vendor does not necessarily economically benefit from investing in addressing cloud security, especially in low-security-loss environments. We also find that the on-premises vendor’s security and customization investments act as strategic substitutes in low-security-loss environments and, under certain conditions, complement in high-security-loss environments. We further examine welfare-maximizing security investments and find that the socially optimal investment requires greater effort to improve cloud security in low-security-loss environments and to improve on-premises software security in high-security-loss environments.