It may also be good to look at 'The market for silver bullets' (2008) [1]. This discusses security products as products where both the seller and buyer do not

It may also be good to look at 'The market for silver bullets' (2008) [1]. This discusses security products as products where both the seller and buyer do not know enough to judge the efficacy of security products. Also where the cost of a breach may be far lower than the PR costs and fallout for example. [1]: http://iang.org/papers/market_for_silver_bullets.html http://iang.org/papers/market_for_silver_bullets.html