Could economic incentives encourage hacks?

Critics argue that rewards can create perverse incentives when payment is tied to exploitable discoveries, accepted reports, or post-attack cooperation. In low-risk cybercrime, even a modest chance of payment may remain attractive. Paying attackers after breaches may therefore increase expected returns and signal that exploitation can be negotiated into a reward.

• When hacker rewards greatly exceed defender rewards, experiments found poorer performance among security analysts and changes in attack decision-making.
• Rewarding attackers who return stolen funds may create moral hazard and potentially encourage further breaches by making exploitation appear financially negotiable.
• Because hacking can be relatively low-risk, reducing the probability of payment may not deter attacks as strongly as it would deter high-commitment physical crimes.
• Bug bounty systems can reward accepted reports rather than measurable reductions in security risk, creating incentives to optimize for report volume or perceived severity.
• Misaligned incentives and slower organizational decision-making can give criminal enterprises an advantage over corporate defenders.

Featured sourceEffects of Motivation: Rewarding Hackers for Undetected Attacks Cause Analysts to Perform Poorlyexa.ai5 sourcesView sources