When the market cannot effectively reward investment in security, cautious vendors bear additional costs while losing market share, and competitors who disregard security free-ride to gain a time advantage, creating a reverse incentive in which security is driven out by insecurity.