Cloud Service vs. On-Premises Software: Competition Under Security Risk and Product Customization

Abstract

Cloud computing services are transforming business and government at an ever-increasing rate. However, the associated security risk and low customization capability create challenges for the penetration of cloud services. In an environment where the negative network security externalities are present, we study the competitive implications when a later entrant cloud provider, who continually makes improvement to its cloud service, competes with an on-premises software provider that offers a customized upgraded product. Using a two-stage game-theoretic model to capture the product differentiation in customization capability and security risk, we highlight the importance of cloud provider’s product development and the role of security externality on consumers’ choices and providers’ strategies. We show that the security loss borne by customers may not always increase in the risk of targeted attacks associated with cloud use, especially when the quality improvement made by the cloud provider is very low. In such circumstance, an increase in the security risk can generate higher profit for the cloud provider. We also demonstrate that under certain conditions, a higher customization capability of the on-premises software makes both providers worse off. We further investigate the cloud provider’s product investment decision. Our results show that in a low switching cost environment, the cloud provider should reduce its investment as the security risk increases, but increase its investment as the customization capability of the on-premises software becomes higher. By extending our base model to consider the providers’ investments in cloud security and product customization, we suggest that the providers should take into account the product quality differentiation when making investment decisions. If the cloud service has a sufficiently high quality, the cloud provider should invest more to reduce the security risk, and the on-premises software provider should respond the high quality service by enhancing its product customization capability.