I agree that security holes can have externalized costs. But I also think labels can make a difference, especially scary ones with words like "security". Look

I agree that security holes can have externalized costs. But I also think labels can make a difference, especially scary ones with words like "security". Look at anti-virus software. While some of it is legit, a lot of it is garbage that doesn't do anything. But people will happily buy (or subscribe) because it promises to improve security. And fear sells. I don't know specifically what the label is going to look like. But let's suppose that the government set 5 years of security updates as the minimum standard. And suppose that if a company only promised to provide 3 years, their product would have to bear a label saying, "WARNING: Does not meet minimum required government computer security standards. May lack software updates that protect from hacking." I think that would discourage a lot of people from buying it. And conversely, if meeting certain security standards allowed the manufacturer to label their product as officially scoring "Very Good" or "Excellent", they'd want to put that on their label. Manufacturers always like to maximize the number of good-sounding things on the box. To the point that they'll invent useless bullet items to fill the space if they can't think of anything else to say.