Why 25 Years of WEIS Papers on Security Economics Matter to Practitioners
A new public archive collects every paper from twenty-five years of the Workshop on Economics and Information Security. For security leaders, it is a free library on why incentives, not just technology, decide how secure systems turn out.
Key Takeaways
- A new archive at papers.econinfosec.org collects the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS).
- Security economics treats failures as incentive problems as well as technical ones: who bears the cost, who holds the information, and who can actually fix the flaw.
- For CISOs and engineering leads, the archive is a vendor-neutral, citable body of research to inform budget cases, policy and procurement decisions.
What has been published
Bruce Schneier flagged on his blog that a new archive now holds all of the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS). The archive is hosted at papers.econinfosec.org. Schneier calls it a "really nice resource" and says he enjoyed rereading his own 2002 essay on the economics of information security, which is also available there.
This is a research-infrastructure story, not an incident. The archive does not disclose a vulnerability or an attack. It still deserves attention from practitioners, because a searchable, public record of a field's accumulated work is useful for anyone who has to justify a security decision to a board, a regulator or a procurement panel.
Why economics belongs in a security programme
Most security guidance is framed technically: patch this, segment that, enforce MFA. The security-economics view asks a different question. Who pays when a control fails, and who is in a position to prevent the failure? When the party that can fix a problem is not the party that suffers its consequences, the problem tends to persist, however good the technical advice is.
That framing explains patterns practitioners see every week:
- Misaligned incentives: a vendor, a supplier or an internal team can ship or accept risk that someone else absorbs.
- Information asymmetry: buyers often cannot tell a secure product from an insecure one, so security is hard to price in at purchase time.
- Externalities: a compromised component in one organisation can create costs for customers, partners and downstream users who had no say in the decision.
How to use the archive
We would not treat the archive as a reading list to finish. We would treat it as a reference to search when a specific decision needs evidence. Some practical uses:
- 1Building a business case. Look for peer-reviewed work on the cost side of a control, rather than relying only on vendor-supplied statistics.
- 2Designing governance. Frameworks such as ISO 27001 and ISO 42001 rely on assigning ownership and accountability. Incentive research helps test whether those assignments will hold up in practice.
- 3Assessing third-party risk. Papers on information asymmetry and shared responsibility can sharpen supplier questionnaires and contract terms.
A caution on reading older research
Twenty-five years of papers span very different threat landscapes. Individual findings should be checked against current conditions before they are cited as fact in a risk register or board paper. The durable value is usually the analytical lens, not any single dataset or conclusion. Where a paper makes a quantitative claim, read the underlying methodology and date before reusing the number.
Why this matters now
Security teams are being asked to justify spend and prove effectiveness in areas where evidence is still thin, including AI systems and software supply chains. Those are precisely the settings where incentives and information gaps dominate. A free, organised archive of the discipline's research lowers the cost of grounding those arguments in published work.
Frequently Asked Questions
What is WEIS?
WEIS is the Workshop on Economics and Information Security. A new archive at papers.econinfosec.org now collects the papers from its twenty-five years.
Who should read the WEIS papers?
CISOs, security architects, risk and compliance leads, and anyone who has to argue for security investment or design incentives, such as procurement and governance owners. The papers are most useful when searched for a specific decision rather than read end to end.
Are older security-economics papers still reliable?
Their analytical frameworks often still apply, but threat conditions have changed over twenty-five years. Check the date and methodology of any figure before citing it, and prefer the reasoning over the numbers.
Sources
- 1Workshop on Economics and Information Security (WEIS) Archive — Schneier on Security
- 2WEIS paper archive — Workshop on Economics and Information Security
Get new posts by email
Security and AI research from our team, when we publish. No spam, unsubscribe anytime.