DISC Research Seminar Series

While it is widely recognized that “complexity is the worst enemy of security,” prior research offers limited insight into when and how information technology complexity (ITC) elevates cybersecurity risk. Drawing on Complexity Theory, we propose that ITC, the diversity and interconnectedness of a firm’s IT ecosystem, is positively associated with data breach risk only after exceeding a threshold. Applying Resource Dependence Theory, we further argue that the breach risk associated with ITC is amplified by vendor diversity, the breadth of a firm’s reliance on external IT vendors. Using a nine-year panel of 15,879 firms (2010–2018), we uncover a threshold below which ITC is not significantly associated with breach risk, but above which the association becomes positive. Moreover, vendor diversity strengthens the positive relationship between ITC and breach risk only when ITC exceeds the threshold. Our mechanism exploration further suggests that reduced visibility and control over IT systems may serve as channels linking ITC to increased data breach risk. This study contributes to the information systems literature by revealing a nonlinear relationship between ITC and cybersecurity risk and by exploring its boundary conditions and mechanisms. Our findings offer practical insights for firms to mitigate breach risk and improve cyber resilience by adopting threshold-aware governance and managing vendor portfolios.

Generative AI is evolving from a decision support technology into an economic intermediary that searches, learns, recommends, and acts on behalf of users. This talk presents two game-theoretic studies of how firms strategically respond to AI intermediation and how those responses shape welfare and governance. The first examines agentic commerce, showing how sellers use generative engine optimization (GEO) and pricing to influence AI shopping agents, potentially overturning the matching benefits of consumer delegation. Consumer sophistication, particularly under human-in-the-loop oversight, can discipline these strategies, but the welfare effects remain heterogeneous, with mid-quality markets most affected. The second examines AI providers’ access to websites, where current congestion must be balanced against information acquisition that improves future AI services. A small access allowance can be worse than an outright ban because commercial expansion can become profitable before it becomes socially beneficial. Moreover, subsequent monopoly repricing can make better AI serve fewer tasks. Together, the studies highlight firms’ strategic responses as a central challenge in governing AI-mediated markets.

As operational sustainability becomes a strategic imperative across industries, firms are striving to manage both environmental performance and operational risk simultaneously. While prior research has identified various drivers of environmental performance, the influence of cybersecurity as an operational risk capability remains largely overlooked. We argue that since environmental sustainability relies on effective management of operational risks, investing in cybersecurity reshapes firms’ production and services processes, generating environmental consequences. Guided by shared value theory, this study examines how cybersecurity investment influences firms’ environmental performance using panel data from S&P 1500 firms between 2015 and 2022. Our results show that higher cybersecurity investment is associated with improved environmental performance. We identify three operational mechanisms driving this relationship: (1) phasing out legacy systems, (2) reconfiguring service delivery through outsourcing of energy-intensive services, and (3) enhancing cybersecurity operations. Importantly, the environmental impact of outsourcing is heterogenous—i.e., cloud services reduce environmental performance, while remote work systems enhance it. We further show that the positive effect of cybersecurity investment on environmental performance is more pronounced in firms with higher sensitivity to consumer public perception (i.e., B2C firms) than those that are less sensitive (i.e., B2B firms). Our findings contribute to the productions and operations management literature by identifying cybersecurity as a key operational capability that links operational risk management with environmental outcomes. We extend existing work on operational sustainability, cybersecurity, and green IT by demonstrating that cybersecurity investments can generate dual benefits of risk management and environmental impact. For managers, our results provide insights into aligning cybersecurity investments with broader operational sustainability objectives.

Will AI take our jobs? Perhaps. But a more immediate question is what AI is doing to our human capital: the expertise and judgment organizations rely on when the machine is unavailable, uncertain, or wrong. In many cases, AI’s effect on human capital is a design choice. Designed well, AI can put mathematical optimization and decision support directly in the hands of frontline workers and senior decision-makers, extending capabilities that have traditionally been concentrated among middle managers and specialists. In a cluster-randomized trial I helped design, for example, autonomous AI increased specialist productivity by 40 percent while expanding access in a resource-constrained setting. Left to default, with little attention to design, the same tools can erode expertise, weaken judgment, and even penalize the professionals who adopt them, thinning the human fallback organizations still need. Drawing on recent work in operations and healthcare, I will examine when AI strengthens human capability, when it weakens it, and how incentives, engagement, and verification shape the outcome.

We study how competing content platforms (e.g., TikTok, YouTube, Facebook, and X) moderate user-generated content while monetizing attention through advertising. Section 230 of the U.S. Communications Decency Act, enacted in 1996, delegates moderation to market forces on the premise that competition will discipline it. Since then, consumption-side competition has intensified and cross-posting tools have strengthened generation-side complementarity. We examine these shifts in a duopoly where sensitive and insensitive users jointly consume and generate content and platforms simultaneously choose moderation and advertising load. A platform's moderation unambiguously cleans its own content, but its effect on the competitor depends on the relative strength of consumption- and generation-side interactions. When platforms are strong generation-side complements-arguably the case today-moderation is a public good: it cleans the competitor and raises its demand, diluting private returns platforms under-moderate relative to centralized and welfare-maximizing benchmarks. Under weaker complementarity, moderation is a quasi-public good: it still cleans the competitor but steals its users on net, yet platforms can still under-moderate. When platforms are generation-side substitutes, moderation is business-stealing: it displaces harmful content onto the competitor and steals its demand, and platforms over-moderate. These spillovers can leave harmful-content generators better off and those moderation is meant to protect worse off. Proposed liability amendments to Section 230 (e.g., the SAFE TECH and EARN IT Acts) may improve welfare only up to a point, beyond which they worsen it. Under sufficiently strong generation-side complementarity, coordination on moderation alone, with advertising competition intact, is collectively profitable and raises moderation on both platforms.

To benefit from technology products, customers must learn to use them. The value of new technologies is often uncertain. So, customers must invest in learning while facing uncertain returns. These challenges hurt vendors' demand and profit. Software vendors can tackle this through three strategies: enhancing customers' learning rates, lowering the learning barrier, and reducing value uncertainty. These strategies are frequently deployed together, making it critical for vendors to understand how they interact to optimize benefits. Are they substitutes such that implementing one reduces the value of the others? Or are there synergies within a subset of strategies that should be deployed together? We investigate these strategic interactions and how the optimal combination of strategies may vary depending on whether the software is sold via perpetual or subscription-based licensing. We employ a Bayesian dynamic model incorporating two learning characteristics: customers’ learning progresses according to a learning curve, and the learning curve’s shape is unknown to customers but can be learned through experience. We show that without uncertainty, enhancing customers' learning rates and lowering the learning barrier are substitutes under both licensing schemes. Both strategies ease learning. An improvement because of one reduces the benefit from the other. In contrast, with uncertainty, the strategic interactions depend on the licensing scheme. Under perpetual licensing, enhancing customers' learning rates and lowering the learning barrier are complementary when customers’ prior beliefs are pessimistic, and learning is difficult, but substitutive otherwise. Reducing value uncertainty complements the other two strategies and should be deployed jointly with them. Uncertainty leads customers to consider an option value, which reshapes how the strategies interact. Conversely, under subscription licensing, reducing value uncertainty generally complements one of the other two strategies but substitutes for the second. Which strategy it complements varies, depending on parameter values. The recurring subscription price introduces a new mechanism that explains the different interactions across licensing schemes.

(updated) This seminar will cover two critical frontiers related to AI: the internal world of academic research production and the external world of public policy. First, "Fighting Fire with Fire: Infusing AI into Peer Review to Sustain Quality Scholarship," will address a "publication paradox" in academia. Increased submission volume due to generative AI will stress human peer-review capacity. We propose a hybrid editorial workflow where journal-specific LLMs act as first-line reviewers, allowing authors to iterate before human experts step in. This approach moves beyond the unvetted, isolated use of AI currently occurring "in the wild" toward a deliberate, institutionally governed framework that preserves epistemic standards. Second, "Exploratory Analysis of AI Legislation in the United States," will examine how society "puts the brakes" on AI technologies. We use text analysis and LLMs to categorize over 1,500 bills across 51 jurisdictions, via a custom seven-element taxonomy rooted in regulatory rationale—such as product safety and market structure. We then analyze the resulting curated corpus to provide empirical insights into state-level policy trends, political influences on legislative outcomes, and the evolving sophistication of AI governance.