Security Patch Management: Share the Burden or Share the Damage?

Hasan Cavusoglu
Hasan Cavusoglu
[email protected]
Sauder School of Business, University of British Columbia, Vancouver, British Columbia V6T 1Z2, Canada
Search for more papers by this author
,
Huseyin Cavusoglu
Huseyin Cavusoglu
[email protected]
School of Management, University of Texas at Dallas, Richardson, Texas 75083
Search for more papers by this author
,
Jun Zhang
Jun Zhang
[email protected]
School of Management, University of Texas at Dallas, Richardson, Texas 75083
Search for more papers by this author

Hasan Cavusoglu

[email protected]

Sauder School of Business, University of British Columbia, Vancouver, British Columbia V6T 1Z2, Canada

Search for more papers by this author

Huseyin Cavusoglu

[email protected]

School of Management, University of Texas at Dallas, Richardson, Texas 75083

Search for more papers by this author

Jun Zhang

[email protected]

School of Management, University of Texas at Dallas, Richardson, Texas 75083

Search for more papers by this author

Published Online:1 Apr 2008https://doi.org/10.1287/mnsc.1070.0794

Supplemental Material

mnsc.1070.0794-sm-ec.pdf (244 KB)

Cited by
- Optimal patching policies for software systems considering dynamic user adoption
  Reliability Engineering & System Safety, Vol. 272
- The economics of cyber risk: a survey of the literature
  19 August 2025 | Journal of Industrial and Business Economics, Vol. 53, No. 2
- On the randomness and improvement of cloud computing capacity in service operations
- An iterative five-phase process model to successfully implement AI for cybersecurity in a corporate environment
  19 June 2025 | Electronic Markets, Vol. 35, No. 1
- Customization or jailbreaking for bloatware: strategic impacts of consumer-initiated behavior of software products
  Expert Systems with Applications, Vol. 291
- An Empirical Study on Vulnerability Disclosure Management of Open Source Software Systems
  14 August 2025 | ACM Transactions on Software Engineering and Methodology, Vol. 34, No. 7
- The cybersecurity entrepreneur
  9 May 2024 | The Review of Austrian Economics, Vol. 38, No. 3
- When Your Thing Won’t Behave: Security Governance in the Internet of Things
  22 August 2024 | Information Systems Frontiers, Vol. 27, No. 4
- Integrated decision of release and patch planning for warrantied smart products considering hardware–software interaction
  International Journal of Production Economics, Vol. 33
- Network Structures, Audit Policies and the Cost of Security Breaches
  25 June 2025 | Production and Operations Management, Vol. 1
- How to Make My Bug Bounty Cost-Effective? A Game-Theoretical Model
  Leting Zhang,
  Emre M. Demirezen,
  Subodha Kumar
  3 September 2024 | Information Systems Research, Vol. 36, No. 2
- Exposure of software vulnerabilities on Twitter: Analyzing vendors’ behavior of releasing software patches
  Computers & Security, Vol. 151
- Decision Making in Information Security Investments: Impact of System Vulnerability and Investment Timing on Resource-Sharing Platforms
  Hui Zhao; ,
  Yong Wu,
  Zhijie Jin
  26 November 2024 | Decision Analysis, Vol. 22, No. 1
- Optimal testing, patching, warranty, and pricing policies for smart products considering hardware–software interaction
  Computers & Industrial Engineering, Vol. 201
- Cybersecurity Challenges for the Internet of Things: Securing IoT in the U.S., Canada, and EU 
  1 January 2025 | SSRN Electronic Journal, Vol. 17
- The Impact of Competition Intensity on Software Security: An Empirical Analysis of Web Browser Patch Releases
  31 October 2024 | Review of Network Economics, Vol. 23, No. 4
- A Statistical Approach to Severity Aware Vulnerability Prioritization
- Automated Severity Driven Patch Management
  10 December 2024
- Lessons from the CrowdStrike Incident: Assessing Endpoint Security Vulnerabilities and Implications
- Privacy computing meets metaverse: Necessity, taxonomy and challenges
  Ad Hoc Networks, Vol. 158
- Entailing Security Mindset in Foundational CS Courses: An Interactive Approach
- Uncertain differential equation based software belief reliability growth model (SBRGM) considering software patching
  8 January 2024 | International Journal of System Assurance Engineering and Management, Vol. 33
- Enterprise Security Patch Management with Deep Reinforcement Learning
  1 January 2024 | SSRN Electronic Journal, Vol. 2
- How to Make My Bug Bounty Cost-effective? A Game-theoretical Model
  1 January 2024 | SSRN Electronic Journal, Vol. 65
- Navigating Software Vulnerabilities: Eighteen Years of Evidence from Medium and Large U.S. Organizations
  1 January 2024 | SSRN Electronic Journal, Vol. 33
- Vulnerability diffusions in software product networks
  16 July 2023 | Journal of Operations Management, Vol. 69, No. 8
- An In-Depth Analysis of Android’s Java Class Library: its Evolution and Security Impact
- Cyber-risk Management Framework for Online Gaming Firms: an Artificial Neural Network Approach
  9 January 2022 | Information Systems Frontiers, Vol. 25, No. 5
- Managing the security of information systems with partially observable vulnerability
  1 September 2023 | Production and Operations Management, Vol. 32, No. 9
- Deep VULMAN: A deep reinforcement learning-enabled cyber vulnerability management framework
  Expert Systems with Applications, Vol. 221
- Understanding and Managing Complex Software Vulnerabilities: An Empirical Analysis of Open-Source Operating Systems
  Systèmes d'information & management, Vol. Volume 28, No. 1
- On the improvement of uncertain cloud service capacity
  International Journal of Production Economics, Vol. 258
- Signal Game Analysis between Software Vendors and Third-Party Platforms in Collaborative Disclosure of Network Security Vulnerabilities
  Complexity, Vol. 2023
- Organizing for permanent beta: performance measurement before vs performance monitoring after release of digital services
  1 February 2022 | International Journal of Operations & Production Management, Vol. 43, No. 3
- Raising the Standard of Maritime Voyage Data Recorder Security
  24 January 2023 | Journal of Marine Science and Engineering, Vol. 11, No. 2
- An empirical analysis of vulnerability information disclosure impact on patch R&D of software vendors
  Journal of Intelligent & Fuzzy Systems, Vol. 44, No. 1
- The Dynamic Update of Mobile Apps: A Research Design with HMM Method
  17 July 2023
- Analysis of vulnerability fixing process in the presence of incorrect patches
  Journal of Systems and Software, Vol. 195
- Upgraded Software and Embedded Improvements: A Puzzle of User Heterogeneity
  1 January 2023 | SSRN Electronic Journal, Vol. 27
- GAME THEORETICAL APPROACH TO THE MODELING OF CONFLICTS IN INFORMATION SECURITY SYSTEMS
  1 January 2023 | Cybersecurity: Education, Science, Technique, Vol. 2, No. 22
- The impact of regulatory mechanisms on vulnerability disclosure behavior during crowdsourcing cybersecurity testing
  Mathematical Biosciences and Engineering, Vol. 20, No. 11
- Economics of Ransomware: Risk Interdependence and Large-Scale Attacks
  Terrence August,
  Duy Dao,
  Marius Florin Niculescu
  7 March 2022 | Management Science, Vol. 68, No. 12
- Why, How and Where of Delays in Software Security Patch Management: An Empirical Investigation in the Healthcare Sector
  11 November 2022 | Proceedings of the ACM on Human-Computer Interaction, Vol. 6, No. CSCW2
- Software security patch management - A systematic literature review of challenges, approaches, tools and practices
  Information and Software Technology, Vol. 144
- Don’t get stung, cover your ICS in honey: How do honeypots fit within industrial control system security
  Computers & Security, Vol. 114
- Vulnerability Selection for Remediation: An Empirical Analysis
  17 September 2019 | The Journal of Defense Modeling and Simulation: Applications, Methodology, Technology, Vol. 19, No. 1
- Patching zero-day vulnerabilities: an empirical analysis
  18 November 2021 | Journal of Cybersecurity, Vol. 7, No. 1
- Vulnerability disclosure mechanisms: A synthesis and framework for market-based and non-market-based disclosures
  Decision Support Systems, Vol. 148
- Failures of Fairness in Automation Require a Deeper Understanding of Human–ML Augmentation
  1 September 2021 | MIS Quarterly, Vol. 45, No. 3
- A grounded theory of the role of coordination in software security patch management
  18 August 2021
- To clean or not to clean: Malware removal strategies for servers under load
  European Journal of Operational Research, Vol. 292, No. 2
- Optimal decisions and Pareto improvement for green supply chain considering reciprocity and cost-sharing contract
  11 February 2021 | Environmental Science and Pollution Research, Vol. 28, No. 23
- Game-Theoretic Analysis of Green Supply Chain Under Cost-Sharing Contract with Fairness Concerns
  3 December 2020 | International Game Theory Review, Vol. 23, No. 02
- Do You Have a Room for Us in Your IT? An Economic Analysis of Shared IT Services and Implications for IT Industries
  1 March 2021 | MIS Quarterly, Vol. 45, No. 1
- Product Life Cycle Perspective on ICT Product Supply Chain Resilience
- The Pricing Strategy of Software
  15 October 2020
- SoK: Anatomy of Data Breaches
  17 August 2020 | Proceedings on Privacy Enhancing Technologies, Vol. 2020, No. 4
- Managing Information System Security Under Continuous and Abrupt Deterioration
  1 August 2020 | Production and Operations Management, Vol. 29, No. 8
- Centralized IT Decision Making and Cybersecurity Breaches: Evidence from U.S. Higher Education Institutions
  18 November 2020 | Journal of Management Information Systems, Vol. 37, No. 3
- Bloatware and Jailbreaking: Strategic Impacts of Consumer-Initiated Modification of Technology Products
  Hasan Cavusoglu,
  Huseyin Cavusoglu,
  Xianjun Geng
  16 March 2020 | Information Systems Research, Vol. 31, No. 1
- Do Reputational Sanctions Deter Negligence in Information Security Management? A Field Quasi‐Experiment
  1 February 2020 | Production and Operations Management, Vol. 29, No. 2
- Prioritization of Different Types of Software Vulnerabilities Using Structural Equation Modelling
  20 June 2020
- Improving vulnerability remediation through better exploit prediction
  14 September 2020 | Journal of Cybersecurity, Vol. 6, No. 1
- Hackers’ self-selection in crowdsourced bug bounty programs
  Revue d'économie industrielle, Vol. 172
- Market Segmentation and Software Security: Pricing Patching Rights
  Terrence August,
  Duy Dao,
  Kihoon Kim
  8 August 2019 | Management Science, Vol. 65, No. 10
- Cyber Risk Assessment and Mitigation (CRAM) Framework Using Logit and Probit Models for Cyber Insurance
  17 November 2017 | Information Systems Frontiers, Vol. 21, No. 5
- The faster the better? Innovation speed and user interest in open source software
  Information & Management, Vol. 56, No. 5
- A Novel Cybersecurity Framework for Countermeasure of SME's in Saudi Arabia
- Two-Dimensional Vulnerability Patching Model
  31 July 2018
- Modeling Vulnerability Discovery and Patching with Fixing Lag
  28 November 2018
- Economics of Ransomware Attacks
  SSRN Electronic Journal, Vol. 5
- VULCON
  12 June 2018 | ACM Transactions on Privacy and Security, Vol. 21, No. 4
- Strategic Aspects of Cyber Risk Information Sharing
  13 November 2017 | ACM Computing Surveys, Vol. 50, No. 5
- SHARE
  7 March 2018 | ACM Transactions on Internet Technology, Vol. 18, No. 3
- Survival of the fittest: understanding the effectiveness of update speed in the ecosystem of software platforms
  13 July 2018 | Journal of Organizational Computing and Electronic Commerce, Vol. 28, No. 3
- Retailer-driven carbon emission abatement with consumer environmental awareness and carbon tax: Revenue-sharing versus Cost-sharing
  Omega, Vol. 78
- A Model of Competition Between Perpetual Software and Software as a Service1
  1 March 2018 | MIS Quarterly, Vol. 42, No. 1
- A matter of time: On the transitory nature of cyberweapons
  16 February 2017 | Journal of Strategic Studies, Vol. 41, No. 1-2
- Antecedents and Consequences of App Update: An Integrated Research Framework
  4 September 2018
- Discrete-Time Framework for Determining Optimal Software Release and Patching Time
  4 October 2017
- Fixing of Faults and Vulnerabilities via Single Patch
  4 October 2017
- Drawing a Line in the Sand: Commitment Problem in Ending Software Support1
  1 December 2017 | MIS Quarterly, Vol. 41, No. 4
- Evaluating intrusion prevention systems with evasions
  22 June 2017 | International Journal of Communication Systems, Vol. 30, No. 16
- When to Release and Stop Testing of a Software
  25 November 2016 | Journal of the Indian Society for Probability and Statistics, Vol. 18, No. 1
- Vulnerability survival analysis: a novel approach to vulnerability management
- Security and privacy in the internet of things
  24 August 2017 | Journal of Cyber Policy, Vol. 2, No. 2
- Defending the grid: Backfitting non-expandable control systems
- Analyzing the Effectiveness of Attack Countermeasures in a SCADA System
  18 April 2017
- Release and testing stop time of a software using multi-attribute utility theory
  12 May 2017 | Life Cycle Reliability and Safety Engineering, Vol. 6, No. 1
- Product Updates: Attracting New Consumers versus Alienating Existing Ones
  SSRN Electronic Journal, Vol. 44
- Testing effort based modeling to determine optimal release and patching time of software
  14 May 2016 | International Journal of System Assurance Engineering and Management, Vol. 7, No. 4
- Managing Enterprise Risks of Technological Systems: An Exploratory Empirical Analysis of Vulnerability Characteristics as Drivers of Exploit Publication*
  8 January 2016 | Decision Sciences, Vol. 47, No. 6
- Economic Impacts of Rules- versus Risk-Based Cybersecurity Regulations for Critical Infrastructure Providers
  IEEE Security & Privacy, Vol. 14, No. 3
- Optimal planning for open source software updates
  8 June 2015 | Proceedings of the Institution of Mechanical Engineers, Part O: Journal of Risk and Reliability, Vol. 230, No. 1
- Impact of Network Structure on Malware Propagation: A Growth Curve Perspective
  17 June 2016 | Journal of Management Information Systems, Vol. 33, No. 1
- Which IT Security Investments Will Pay Off for Suppliers? Using the Kano Model to Determine Customers' Willingness to Pay
- Action, Inaction, Trust, and Cybersecurity's Common Property Problem
  IEEE Security & Privacy, Vol. 14, No. 1
- IT Governance, Security Outsourcing, and Cybersecurity Breaches: Evidence from the U.S. Higher Education
  SSRN Electronic Journal, Vol. 2
- Research Note—Patching the Cloud: The Impact of SaaS on Patching Strategy and the Timing of Software Release
  Vidyanand Choudhary,
  Zhe (James) Zhang
  28 December 2015 | Information Systems Research, Vol. 26, No. 4
- Information Disclosure and the Diffusion of Information Security Attacks
  Sabyasachi Mitra,
  Sam Ransbotham
  18 August 2015 | Information Systems Research, Vol. 26, No. 3
- Modeling the side-channel attacks in data deduplication with game theory
- Optimal Policies for Security Patch Management
  Debabrata Dey,
  Atanu Lahiri,
  Guoying Zhang
  22 July 2015 | INFORMS Journal on Computing, Vol. 27, No. 3
- Allocation of resources to cyber-security: The effect of misalignment of interest between managers and investors
  Decision Support Systems, Vol. 75
- Securing interdependent assets
  29 March 2014 | Autonomous Agents and Multi-Agent Systems, Vol. 29, No. 2
- The Cyber Security Ecosystem: Post-global Financial Crisis
  26 August 2014
- Software measure in cyber-attacks on production control system
  Computers & Industrial Engineering, Vol. 76
- Security triage
  18 September 2014
- Cloud Implications on Software Network Structure and Security Risks
  Terrence August,
  Marius Florin Niculescu,
  Hyoduk Shin
  21 July 2014 | Information Systems Research, Vol. 25, No. 3
- The Influence of Software Process Maturity and Customer Error Reporting on Software Release and Pricing
  Terrence August,
  Marius Florin Niculescu
  14 June 2013 | Management Science, Vol. 59, No. 12
- Market Impact on IT Security Spending
  19 June 2013 | Decision Sciences, Vol. 44, No. 3
- Game theory meets network security and privacy
  3 July 2013 | ACM Computing Surveys, Vol. 45, No. 3
- Operations Research (OR) in Service Industries: A Comprehensive Review
  18 April 2013 | Systems Research and Behavioral Science, Vol. 30, No. 3
- A Formal Framework for Patch Management
  International Journal of Interdisciplinary Telecommunications and Networking, Vol. 5, No. 2
- Teaching the security mindset to CS1 students
  6 March 2013
- The Impact of Immediate Disclosure on Attack Diffusion and Volume
  27 July 2012
- Fixed Costs, Investment Rigidities, and Risk Aversion in Information Security: A Utility-theoretic Approach
  27 July 2012
- Information Security and Open Source Dual Use Security Software: Trust Paradox
- Are Markets For Vulnerabilities Effective?1
  1 March 2012 | MIS Quarterly, Vol. 36, No. 1
- Optimizing Network Patching Policy Decisions
- Information security trade-offs and optimal patching policies
  European Journal of Operational Research, Vol. 216, No. 2
- A signal game model on security defense of information system
- Who Should Be Responsible for Software Security? A Comparative Analysis of Liability Policies in Network Environments
  Terrence August,
  Tunay I. Tunca,
  25 March 2011 | Management Science, Vol. 57, No. 5
- Evolutionary Game Analysis of Security Information Sharing in Virtual Enterprise
- The Impact of Malicious Agents on the Enterprise Software Industry1
  1 September 2010 | MIS Quarterly, Vol. 34, No. 3
- An Economic Analysis of the Software Market with a Risk-Sharing Mechanism
  8 December 2014 | International Journal of Electronic Commerce, Vol. 14, No. 2
- Optimal Security Patch Release Timing under Non-homogeneous Vulnerability-Discovery Processes
- The critical elements of the patch management process
  1 August 2009 | Communications of the ACM, Vol. 52, No. 8
- Configuration of and Interaction Between Information Security Technologies: The Case of Firewalls and Intrusion Detection Systems
  Huseyin Cavusoglu,
  Srinivasan Raghunathan,
  Hasan Cavusoglu,
  26 February 2009 | Information Systems Research, Vol. 20, No. 2
- Dynamics of organizational information security
  13 November 2008 | System Dynamics Review, Vol. 24, No. 3
- Computer Virus Propagation in a Network Organization: The Interplay between Social and Technological Networks
  SSRN Electronic Journal, Vol. 5
- Assessing the Value of Network Security Technologies
  SSRN Electronic Journal, Vol. 52
- Optimal Policy for Software Vulnerability Disclosure
  SSRN Electronic Journal, Vol. 52

Volume 54, Issue 4

April 2008

Pages iv-862

Article Information

Supplemental Material

Metrics

Information

Received:January 10, 2005
Published Online:April 01, 2008

Cite as

Hasan Cavusoglu, Huseyin Cavusoglu, Jun Zhang, (2008) Security Patch Management: Share the Burden or Share the Damage?. Management Science 54(4):657-670.

https://doi.org/10.1287/mnsc.1070.0794

Keywords

PDF download

Available Issues

Available Issues

Available Issues

Available Issues

Available Issues

Available Issues

Available Issues

Available Issues

Available Issues

Security Patch Management: Share the Burden or Share the Damage?

Supplemental Material

Volume 54, Issue 4

Article Information

Supplemental Material

Metrics

Information

Cite as

Keywords

Sign Up for INFORMS Publications Updates and News