NBER WORKING PAPER SERIES SECURING THEIR FUTURE? ENTRY AND SURVIVAL IN THE INFORMATION SECURITY INDUSTRY. Ashish Arora Anand Nandkumar

Transcription

1 NBER WORKING PAPER SERIES SECURING THEIR UTURE? ENTRY AND SURVIVAL IN THE INORMATION SECURITY INDUSTRY Ashish Arora Anand Nandkumar Working Paer 3634 htt:// NATIONAL BUREAU O ECONOMIC RESEARCH 050 Massachusetts Avenue Cambridge, MA 038 November 007 The views exressed herein are those of the authors and do not necessarily reflect the views of the National Bureau of Economic Research. 007 by Ashish Arora and Anand Nandkumar. All rights reserved. Short sections of text, not to exceed two aragrahs, may be quoted without exlicit ermission rovided that full credit, including notice, is given to the source.

2 Securing Their uture? Entry And Survival In The Information Security Industry Ashish Arora and Anand Nandkumar NBER Working Paer No November 007 JEL No. L4,L5,L6 ABSTRACT In this aer we study how the existence of a functioning market for technology differentially conditions the entry strategy and survival of different tyes of entrants, and the role of scale, marketing ability and technical assets. Markets for technology facilitate entry of firms that lack rorietary technology and increase vertical secialization. However, they also increase the relative advantage of downstream caabilities, which is reflected in the relatively imroved erformance of incumbent Information and Communication Technologies ICT firms comared to startus. We find that diversifying entrants erform better relative to startus. Contrary to earlier studies, we find that sin-offs do not erform any better than other startus. Moreover, firms founded by serious hobbyists and tinkerers, whom we call hackers, erform markedly better than other startus. These findings reflect the non-manufacturing setting of this study, as well as the distinctive nature of software technology. Ashish Arora Heinz School, Carnegie Mellon University 508 Hamburgh Hall 5000 orbes Avenue Pittsburgh PA 53 ashish@andrew.cmu.edu Anand Nandkumar Heinz School, Carnegie Mellon University 50 Hamburgh Hall 5000 orbes Avenue Pittsburgh PA 53 anandn@andrew.cmu.edu

3 . Introduction: Studies of industry evolution conclude that established firms tend to outerform startus Dunne et al., 988; Mitchell, 99; Kleer and Simons, 000a; Kleer, 00. A variety of ossible sources of advantage have been identified. Established firms are larger, endowed with comlementary assets like distribution and marketing networks, better management caabilities, and even erhas suerior technology. The relative imortance of these factors in the advantage that established firms enjoy over startus remains unclear. The literature also concludes that the re-entry exerience of entrants is very imortant, so that sinoffs from existing firms or startus from related industries outerform others. Once again, the recise nature of the relevant rior exerience is less clear Chatterji, 006. Existing literature imlicitly focuses on firms that rely uon internally generated technologies. We exlicitly consider how markets for technology condition the entry strategy and the subsequent erformance of entrereneurs, and changes the relative value of different tyes of firm cometencies. At the very least, the existence of technology suliers exands the strategy sace of the entrereneur. As Gambardella and Giarratana 006 oint out, technology holders may choose to license technology to others. Other entrants, esecially incumbent ICT firms diversifying into the Information Security Market ISM may find it more rofitable to acquire external technology than to develo the technology by themselves. Arora, osfuri and Gambardella, 00, Gans, Hsu and Stern,00. In addition, markets for technology may also condition the subsequent fate of entrants. Lowered entry barriers may mean more cometition and greater likelihood of exit. More interestingly, the relative erformance of different tyes of entrants may also be affected, Gambardella and Giarratana 006 analyze the factors that condition how encrytion technology holders choose between licensing technology rather than offering roducts for sale.

4 changing the relative imortance of roduction and marketing ability comared to technical ability. To answer these questions we develo a novel dataset of entrants in the ISM. Before the internet, comuter attacks, with the excetion of viruses, were largely restricted to large comuter networks tyically owned by the government. The large scale adotion of the internet in the mid 990 s meant that a growing amount of commercially valuable data had to be rotected against attackers, accidental loss, and rying eyes. The growth of digital roducts including songs and videos required means of controlling the access and use of those roducts. urther, online commerce required authenticating articiants, secure communications and controlling access. More recently, users have to be rotected against sam and hishing attacks, which induce unwary users to art with confidential information. Thus, the ISM consists of several submarkets that emerged at different oints in time. Given the general-urose nature of information technology, entrants into the ISM are diverse: software, hardware or telecommunication equiment roducers, startus with founders from these same IT industries, as well as from industries such as defense and financial services have all entered the ISM. However, what erhas distinguishes the ISM is the rarity of sinoffs and erhas also the number of ioneering startus founded by very skilled hobbyists or tinkerers, whom we shall call hackers. This aer is organized as follows: section rovides a brief background on information security technologies. Section 3 reviews literature and rovides a theory that guides our emirical analysis in section 5. Section 4 rovides a descrition of the data. In section 6 we conclude with a summary of our key findings of this work. Hackers lack advanced degrees in comuter sciences, nor do they hold imortant ositions in established ICT firms at the time of founding. Yet, in ISM, they are among the ioneers and, more interestingly, the source of many of the current market leaders. 3

5 . Information security market: our major tyes of technologies are involved in securing information and comuter networks: i Encrytion, to disguise data and reserve confidentiality of transactions ii Packet insection and filtering, based on attern matching for firewalls, anti-virus and intrusion detection iii Image matching, to identify end users to systems based on their hysical attributes such as fingerrints, retina and iv Single sign on technology to enable users to be authenticated to multile systems just using own common assword. i Encrytion: Encrytion relies heavily uon the science of crytograhy. Before the internet, encrytion was used to rotect communication, such as communication between ATM terminals and central banking servers. Innovation in comuter networking accentuated the need for more sohisticated methods of encrytion on a ublic comuter network, resulting in the invention of ublic key encrytion in Encrytion uses encrytion keys generated by multilying two large random rime numbers. Decrytion, on the other hand, involves factoring this large number to figure to discover the rime number that was originally used to encryt the data. Public key crytograhy was first alied for encryting . Internet and e-commerce, and the increased sohistication of attacks, increased the need for encrytion technology. This in turn, meant larger keys had to be used to encryt data which, required greater rocessing ower. Also, the need for encrytion solutions on small devices such as smart cards, cell hones and PDAs where limited amount of data, including encrytion strings, can be stored required more efficient methods of encrytion. Certicom, another imortant layer in the encrytion market, successfully invented a more efficient algorithm for ublic key crytograhy called ellitic curve crytograhy in 997. At resent RSA and 3 In 976, a ublic key technology called the Diffie-Hellman algorithm was invented at Stanford in 976. RSA, another key algorithm for ublic key crytograhy was invented at MIT in

6 ellitical curve algorithms invented by Certicom are the two most widely used encrytion methods to rotect data. ii Pattern Matching and filtering: Pattern matching technology builds on routing technologies that direct internet communications. These roducts scan network traffic and make decisions based on arameters such as the source and destination of internet traffic. The advent of the internet required more sohisticated filtering and checks. The most imortant filtering technology is the stateful insection technology, which, is a method to kee track of revious communication between two networked comuters. This technology was invented by, Checkoint Technologies, a startu established in Israel, in 996. iii Image matching: Image matching or biometric technologies are used to verify or recognize the identity of a erson based on a hysical characteristic like fingerrints or retina atterns. There are three basic methods a mechanism to scan and cature an image; comression, rocessing and comarison of the image to a database of stored images; and 3 interface with alications systems 4. Large hardware roducers like Hughes, IBM, Burroughs and Harris Cororation, and defense contractors were among the early articiants in this technology, as biometric technologies were used rincially by government agencies and financial firms rior to 997. With increased use of mobile comuting, the demand for biometric technologies has grown raidly. iv Single sign on: Single sign on technologies are algorithms that enable users to use one assword and log on to multile comuter systems. or examle, Kerberos invented at MIT, is widely used in universities to authenticate students and staff to multile systems with just one 4 Source htt:// Retrieved ebruary 4th,

7 assword. Since one of the selling oints of e-commerce was the ability to conduct transactions between two unknown arties, verifying identify instantaneously became another critical function of this technology. v Services: In addition consulting firms advise enterrises about comliance with regulatory mandates, including HIPPA, Sarbanes Oxley, Basle II, Gramm-Leachman-Bailey, and various DoD mandates, such as Phis and Common Criterion. ISM roducts tyically combine one or more of ISM technologies see table below 5 as a roduct to cater to the needs of users. or instance, a Virtual Private Network VPN roduct uses encrytion to enable organizations and deskto users to securely communicate using the internet. Authentication roducts use encrytion sometimes combined with attern or image matching to regulate user access to the network. Entrants into the ISM can either be in the roduct market also called downstream, in the licensing market ustream, or both also called both. In our data, there are few ustream entrants, all of them licensing encrytion technology. RSA and Certicom are two of the most successful firms that license encrytion technology mainly to network security and authentication roduct vendors. 6 Other technologies such as image matching, attern matching and single sign on are sold by vendors that also sell roducts incororating the technology. or instance, Symantec not only sells an antivirus roduct, but they also license attern-matching technology. Similarly, Checkoint not only manufactures and sells firewall known as irewall-, but it also licenses attern matching technology to other firewall roducers. 5 In our emirical analysis, we shall frequently grou downstream segments into two - those based on encrytion technologies, and those based on other technologies. However, the results are not affected by treating firewalls, antivirus, sam, hardware and consulting as distinct from each other and from network security, authentication and encrytion roducts. Neither are our results affecting by treating only network security and encrytion roducts as encrytion based and leaving out authentication which also relies uon single sign-on technology, and erhas also image matching. 6 RSA after its merger with Security Dynamics in the late 990 s entered roduct markets. 6

8 Table ISM technology and roduct ma Encrytion Image-matching Pattern matching Single Sign-On irewall Antivirus Authentication Sam Network VPN Encrytion Hardware Consulting 3. Previous literature and Theory Our work draws from two streams of literature: strategy literature and entrereneurshi literature. Evolutionary economists conjecture that the historical antecedents of entrereneurs, esecially re-entry exeriences not only condition entry strategies, but also subsequent erformance. These caabilities include technology, roduction exertise and facilities, brand name and reutation, human assets, established marketing channels, that are tyically rare, valuable, imerfectly mobile Barney, 99; Markides and Williamson, 996 and tyically must be accumulated internally Dierickx and Kool, 989. In fact, many emirical researchers take the view that one reason that firm size is ositively correlated with survival is because firm size catures the effects of learning and accumulation of relevant cometitive assets ost entry Geroski, 995, a fact that is also true of small firms See Audretsch and Mahmood, 995 or Dunne et al 989 for examle. Diversifying entrants tend to enter industries whose resource requirements are similar to their own. or instance, in the television industry, many of the early entrants were radio roducers Kleer and Simons, 000a. Similarly in the automobile industry, entrereneurs with exerience in manufacturing carriages and bicycles not only entered early relative to other entrants but also survived longer Kleer, 00. Many studies of large manufacturing firms 7

9 conclude that a greater fit between the resource requirements of the new industry and that of the otential entrant increases the likelihood of entry Chatterjee and Wernerfelt, 99; Chang, 997; Merino and Rodriguez, 997; Silverman, 999. The fit could be based on technology or marketing. or instance, in the television industry, 4 out the 6 to radio roducers in 940 diversified into the television industry Kleer and Simmons, 000. Similarly, in the automobile industry about 47% of the entrants diversified from related industries that included bicycle, carriage or engine manufacturing Carroll et al, 996. Although diversifiers are the most imortant tye of entrant, startus, including firms sun out of existing roducers sinoffs, tyically constitute the majority of entrants Dunne, Roberts, and Samuelson, 988. Sinoffs may occur due to disagreements between the manager and emloyee Kleer and Thomson, 005 tyically about how best to exloit new idea. Sinoffs could also occur when roerty rights are non-existent or weak or when the emloyee owns the rights to an invention Anton and Yao, 995. When the external environment is conducive to startus arent firms might actively encourage exloration of new ideas and exloit it in house Hellmann, 006. Unlike other industries studied by scholars, there are far fewer sinoffs in ISM comared to other industry settings, erhas reflecting the relative youth of ISM. Lead users, with extensive knowledge of consumer references, were also sources of entry into even manufacturing centric industries such as tyesetting Trisas, 00. Many industries also witness entry by entrereneurs with very secific technical knowledge. In the medical devices industry, for instance, clinical doctors often identify oortunities that lead to new tyes of devices Chatterji, 006. Pre-entry exerience may also be critical for subsequent erformance Helfat and Lieberman, 00. or instance, Thomson 00, using data on the shi building industry, 8

10 found that re-entry exerience of entrants has a strong and long- lasting ositive effect on firm survival that went beyond scale economies and learning subsequent to entry. Kleer 00 and Carroll et al, 996 found similar atterns for automobiles, Mitchell 989 for medical imaging, and Kleer and Simons, 000a for televisions. However there is less consensus on which tyes of re-exerience is more valuable, erhas because the nature of industry dictates which exeriences are more valuable than others. or instance, in televisions, the ability to conduct R&D was a distinct source of advantage to the radio manufactures that not only enabled them to enter early but also survive longer Kleer and Simons, 000a. In the medical imaging industry, the advantage to diversifying entrants was due to their sueriority in sales and distribution Mitchell, 989. Similarly, while rior research has shown that re-entry exeriences of founders influence subsequent erformance of startus, the tye of exerience that conditions subsequent erformance varies with the industry that is investigated. Startus from related arents were more likely to succeed in automobiles Kleer, 00 and shibuilding industries Thomson, 00 by virtue of their exerience in fabrication. In lasers, sinoffs succeeded based on their technical exertise gained while working for the arent Kleer and Sleeer, 005. In other industries, sinoff success was based on non-technical learning, such as knowledge of DA aroval rocess in medical devices Chatterji, 006. In our emirical analysis we comare the subsequent erformances of different tyes of entrants and also the sources of such erformance advantages. Prior work by strategy scholars indicates that not only do markets for technology exist within ISM, but more imortantly they also condition firm strategy Arora, osfuri and Gambardella, 00; Gans, Hsu and Stern, 00. Encrytion technologies are atent intensive 9

11 relative to other ISM technologies and are extensively licensed Giarratana, 004. Gambardella and Giarratana 007 analyze how markets for technology affect the choice between licensing or develoing a roduct. We exlore how the resence of markets for technology influences entry strategy and subsequent erformance of firms in the ISM. Also we exlore which cometencies are relatively more imortant than others both in the resence and absence of markets for technology. Theory We motivate our emirical analysis with a stylized model to derive redictions to guide our emirical analysis. We make several simlifying assumtions, articularly about inter-firm heterogeneity and the sources of re-entry uncertainty to develo a tractable model where both the roduct market and the market for technology are in equilibrium. An imortant simlification is that we do not analyze industry dynamics. Rather, all firms enter at the same time. At the time of entry, firms are uncertain of their rofitability in the roduct market. ollowing entry, this uncertainty is resolved and some firms exit. The market clearing rices in the roduct and technology markets reflect this entry and exit. Notation and assumtions: We assume that firms entering the roduct market require technology and the ability to roduce and market the roducts. A roortion of the otential entrants, λ, are endowed with a technology, while others have to acquire it from a technology sulier. irms endowed with technology decide whether to enter only the roduct market downstream, only the technology market ustream or both both segment. irms differ in how efficiently they can roduce and sell an ISM roduct. In general, efficiency is multifaceted. However, we assume that more efficient firms roduce and sell a 0

12 higher quantity denoted by q. Thus q is a summary measure of the differences in efficiency as well as scale, and is distributed in the oulation with distribution function q. The cost function for firms in the roduct market is cq + θ, where c is the marginal cost and θ is a fixed cost. 7 The actual fixed cost of each firm is θ + ε, where ε is a mean zero iid random variable. At the time of entry, firms do not observe ε, and thus are uncertain about their true rofitability in the roduct market. However after entry, this uncertainty is resolved. This is a simle modeling device to roduce exit from the roduct market, and is a variant of the aroach used in Jovanovic 98. Ignoring roduct heterogeneity, we assume that the demand for the roduct D, is decreasing in, the roduct rice. Modeling the technology market is more challenging. We adot a reduced form aroach. Each licensor earns license revenues of L. Licensees buy technology at a rice of τ. We do not model how τ is determined. Instead, τ is simly assumed to be a decreasing function of the total number of licensors, M. We further assume that there are diseconomies of scoe when firms enter both segment, denoted by γ er unit of outut roduced and sold by the firm. This cost denotes the rent dissiation effect due to erosion of rofits due to another firm licensees cometing in the roduct market Arora and osfuri, 003. All licensors incur a sunk entry cost of E. inally, we assume that there are some technology suliers that are ure licensors, whose number, b, is exogenous to the model. These can be thought of reresenting inventors and university researchers that have develoed technology that they offer for license. Underlying this reduced form we have in mind a situation where technologies offered for license are symmetric but each otential buyer has some idiosyncratic references, reflecting its own market niche. Licensors comete for each otential buyer in a Vickery tye second rice 7 Even for digital roducts such as information security roducts, there are incremental costs of reaching and servicing additional buyers, customizing roducts for their needs and so on.

13 auction. The winning licensor is aid the incremental value it offers over the next best bidder. This would lead to the familiar outcome where the market is divided equally among the suliers and all suliers charge the same non-zero rice, which decreases with the total number of suliers, but does not deend uon the number of buyers. Profits Profits in the downstream segment roduct market are given by П D = -cq θ. The rofits of firms that both suly technology and roduce is given by П B = -c-γq θ+l-e. The rofits of a firm that only sulies technology is given by П L = L-E. Entry irms not endowed with technology enter only exected rofits -cq - θ are greater than θ + τ τ, the cost of licensing technology. The robability of entry is given by. igure c q lots the rofit of different tyes of entrants as a function of q. irms endowed with technology do not roduce but instead only license when θ > q. When cγ θ < q < cγ LE, they γ both sell roducts and license, and exclusively sell roducts when q > LE. irms not endowed γ θ +τ with technology enter when q >. The share of entrants with technology that enter both is c given by L E θ λ. Similarly, the share of entrants with technology that γ cγ exclusively sell is just L E λ γ., and the share that only license is θ λ cγ Exit: Post entry, firms realize an oerating cost of θ+ε, where ε denotes iid shocks that is mean zero, distributed H.. The robability of exit for firms that enter downstream is given by the

14 robability that -cq θ+ε<0, which is just -H[-cq θ]. irms that entered the both segment have a higher robability of exit given by -H[-c-γq- θ]. Note that we imlicitly assume that firms that are exclusive technology suliers do not exit the ISM. Our data largely suorts this assumtion. Of a total of 7 ure technology suliers, only exited. 8 Profits Π D -cq -cq Π B Π - licensee Π L= L-E -c-γq L-E-θ -θ -θ - τ Pure licensor Both Downstream θ q ** = cγ ~ θ + τ q= c L E q*= γ Licensees downstream igure Entry strategy as a function of q q Market Equilibrium Market equilibrium involves two interrelated markets: The roduct market and the technology market. Equilibrium in roduct market imlies that the quantity sulied by roducers must equal the quantity demanded. The quantity sulied in the roduct market is the total quantity sulied by the survivors in the roduct market. This condition is thus given by 8 The assumtion of no exit from the licensing market is made mostly for modeling convenience. We conjecture that allowing exit from the licensing market will not qualitatively affect our results. It does, however, comlicate exit robabilities for firms in the both segment. 3

15 = + c E L c E L d q c qh c d q c qh c E L d q c qh E L T D τ θ γ γ θ γ θ τ θ λ θ γ γ θ γ λ θ γ λ In the technology market, market clearing is more subtle. Any given licensor can sell as many licenses as required. The equilibrium condition is that the total license revenues of all technology suliers, should equal the total licensing ayments. The former is LM, and the latter is equal to the number of licensees multilied by the license rice τ. T c LM + = τ θ τ λ where M is given by b E L T M + = γ λ 3 To get some intuition into these market clearing conditions, figure shows how M and are related for each market clearing condition. The PP curve reresents equilibrium in the roduct market, and TT curve reresents equilibrium in the technology market. While PP curve is downward sloing, the TT curve is uward sloing all roofs are contained in the aendix. The intersection reresents market equilibrium, with * and M* as the equilibrium rice and technology suliers. igure shows that an increase in b increases M* and reduces *. The model has a number of testable redictions. The formal statements and roofs are all contained in the aendix. Here we state the results verbally. As shown in figure, it redicts that larger firms will, if they enter, roduce rather than license, even if these firms have rorietary technology. Licensing to others is not attractive because such licensing creates cometition in the roduct market and dissiates rents. In our emirical analysis, we measure

16 the entrant size. However, we have a number of other measures that lausibly roxy for different dimensions of efficiency such as the number of trademarks, as well as whether the firm is an existing firm entering the ISM market. M M** P P Inc. in b T Inc. in b T M * T T P P ** * igure Equilibrium Result : Increases in firm scale increases the roortion of downstream entry. More generally, increases in firm efficiency increase the roortion of downstream entry. The model imlies that an increase in b increases the robability of entry into the downstream segment by firms endowed with technology, as well as those that are not. An increase in b has two effects. It decreases the license rice, τ, and reduces, the roduct rice. or roducers endowed with technology, an increase in b makes licensing less attractive: the firm indifferent between downstream and both now refers downstream. or firms without technology, the net effect is to encourage entry, which by definition is downstream. Result : An increase in cometition in the market for technology will increase the robability of downstream entry. 5

17 If cometition in the market for technology lowers entry barriers into the roduct market, this also imlies more intense cometition in the roduct market. More intense cometition should hurt the average erformance, increasing the likelihood of exit or slowing growth rates. When more firms enter due to lower entry barriers, rices fall, resulting in higher exits rates on average. Thus, a reduction of entry barriers increases the robability of exit by increasing the overall number of firms and lowering rices. In our model, entrants account for this higher robability of exit in their entry decisions. However, since there is no sunk entry cost, this does not affect their entry decisions. A modest entry cost will not change the result since ultimately the higher exit is due to lower rices, which will only haen if there is net entry. Result 3: Increased cometition in market for technology will increase average exit rates. Since the robability of exit is decreasing in q, firms with higher values of q are less likely to exit, all else equal. More generally, efficient roducers and marketers of roducts are, all else constant, less likely to exit the ISM as well. Result 4: Increases in firm scale reduce exit. More efficient firms have a lower robability of exit relative to less efficient firms. The final result concerns how increases in the cometition in the market for technology differentially affect firms with different scales of oeration. In our model, there are two offsetting forces. irms with larger q are more likely to suffer greater losses from a dro in rice. However, more efficient and larger firms are also more likely to survive cost shocks relative to less efficient firms. Which of these effects dominates deends uon the distribution of the cost shocks. We show that under some restrictions, which are, for instance satisfied by the exonential family including the normal, the latter effect outweighs the former, so that an increase in cometition in the market for technology increases exit for smaller firms by more, 6

18 than for larger firms. Although this result is a limited one, we believe it reflects a broader intuition, namely that as technology becomes cheaer, the sources of differentiation shift towards other sorts of assets, including roduction and marketing. In our model, we do not allow for differential access to technology, or for a cometitive advantage to firms with rorietary technology. We conjecture that in a model with these features such a result would hold a fortiori. Result 5: Increased cometition in market for technology increases average exit rate by more for smaller firms than for larger firms. 4. Data: Our samle consists of 343 security firms, followed from the time of entry until 004 or their exit, whichever is earlier. rom the Cortech directory, we obtained names of all firms that entered ISM between 989 and 004. This dataset was manually augmented with information on submarkets of entry using Internet archives an internet web site that maintains historical archives of many web sites. irms in our samle exited due to two reasons: non viability of the business death or acquisition by another firm merger identified using Lexis-Nexus mergers and acquisitions database. These were coded searately in the dataset. We distinguish between successful acquisitions based on reorted transaction values and distress acquisitions. As we will exlain later, while comaring erformance of firms in the ISM we treat the successful acquisitions as censored observations and distress acquisitions as death. In addition, we recorded the sources of entry by tracking information about the founders for u to 4 founders of security firms. Such data was collected from a variety of ublicly available data sources on the internet such as oominfo LinkedIn 7

19 Google Archives Internet Archive and, EDGAR database. We classified startus into one or more of the following categories based on the immediate rior exerience of founders: sin-offs firms founded by emloyees of an ISM firm, related startus startus founded by emloyees of comuter hardware, software or telecommunication firms, unrelated startus founders from defense, finance, aerosace and automobile industries, university founders, hackers 9 and IT consultants. 0 In our emirical analysis, we frequently club unrelated startus with hackers and universities referred to as other category henceforth thereby, focusing the analysis on diversifiers, related startus sinoffs and unrelated startus. or all samle firms, we also collected the number of security related atents and all IT trademarks held by the firms at the time of entry into ISM from the U.S.PTO database. Security related atents are those that belong to the US atent technological classes 705 subclass 50-79, 380 and 76. We then weighted the atents using the number of forward citations to account for their relative value and imortance of atents Trajtenberg, 990. or IT trademarks, we did keyword search on the U.S.PTO trademarks database htt://tess.usto.gov to gather the number of IT related trademarks held by the firm. We also collected data on licensing transactions from the Lexis-Nexus database. We were able to identify if firms entered the ISM by licensing a technology only in the case of 0 firms. We use data on licensing transactions only in auxiliary regressions to test the robustness of our main results. 9 Hackers are defined as those that a do not have a CS or EE degree, b do not have high level exerience in IT firms and c were self-emloyed rior to founding the firm. 0 IT consultants are those that a have a CS or EE degree and b were self emloyed rior to founding the firm. We used the following search query on the trademark database. Trademark descrition includes "comuter" OR "hardware" OR "ixel" OR "telecom" OR "telecommunications" OR "software" OR "Wireless" OR "comuting" OR "database" OR "data base " OR "ixels" OR "comuter rogram" OR "Network" OR "LAN" OR "Networking" OR " comuter rotocol " OR " Internet ". 8

20 We also identified the submarket of entry for all the firms using internet resources as stated above. or each entrant we first determined the submarket of entry. We then identified if entrants were selling only technology in which case they were classified as being technology suliers or ustream. irms that were selling only roducts were classified as downstream firms, while firms that sold both roducts and technology were classified as oerating in both markets. In the data set there are 7 technology suliers that entered the ISM. We also recorded the size of firms at the time of entry into the ISM. or startus this is the number of emloyees at the time of entry into the ISM. or diversifying entrants, we calculated size at the time of entry as follows: we first identified all the markets in which, diversifying entrants oerated in at the time of entry; we then divided the total emloyees of the diversifier by the total number of markets that diversifiers oerated in to get the size at the time of entry for diversifiers. Table Descrition of measures used Variable Descrition N Mean Std. Dev Downstream Log +security atents A dummy variable= if the entrant enters downstream segment conditional uon entering ISM Log of + # of weighted security atents held by a firm at entry. This variable roxies technical caability Log + IT trademarks Log of IT trademarks held by firm at entry Log +tech.suliers Log of + lagged technology suliers. This is a roxy for MT Log+Size Log of + # emloyees at entry. This is a roxy for scale Encrytion market dummy Dummy variable for markets that use encrytion technology; covers NW security, authentication and encrytion roduct markets Licensee A dummy variable= if an entrant enters the ISM by licensing technology Industry age Age of the industry measured from ISM tenure Calculated as current year ISM entry year ICTdummy = if the entrant is a diversifying ICT entrant

21 Unrelated startu dummy = if the entrant has a founding member from an unrelated industry Related startu dummy Startu with a founder from an ICT firm Cometitors Lagged number of roducers in the same submarket Sources of firm formation and atterns of entry into ISM: The ISM has grown considerably over the ast 5 years. The industry thusfar has not exerienced a shakeout, as also confirmed by Giarratana 004. In the 980s, ISM mainly comrised of technologies rather than roducts used by a handful of enterrises and mainly by the defense industry. Entry figure shows two eaks first around 989 and the second one around 995. The first eak was largely an after-effect of moris worm that sarked research in antivirus and network security technology. The advent of the internet increased entry, articularly by startus Entry Exit Total firms igure 3 - Entry and exit into ISM Entrants into the ISM have diverse origins table. About 83% of the entrants into the ISM are startus, broadly similar to that of automobile industry. About 58% of the startus 0

22 about 48% of all entrants have at least one founding member from a related industry such as comuter hardware, software or telecommunications industry, a roortion, very similar to automobiles where related startus were 47% of total entrants. Table 3- Sources of entry in ISM Entrant tye ISM Automobiles TV industry Medical Laser devices Diversifiers 7% 7% a ; 35% b 30% e - - Hackers 0% Related startus 45% 47% a Unrelated % 3% a - 34% c,y 44% d startus University 8% - - 9% c,z 6% d Sin-offs 5% 0% 8% Notes: The total roortion adds u to more than 00% because many firms have multile founders. In our emirical analysis we club hackers and University rofessors with unrelated startus. a Carroll et al, 996; b Kleer, 00; c Chatterji, 006; d Sleeer, 996; e Kleer and Simons, 000a z Comared with clinical doctors in medical devices industry. y Entrants from defense, financial services, insurance and aerosace comared with outsider + serial entrereneurs in medical devices industry. The ISM also witnessed entry by university based startus articularly in encrytion, a attern that was true of the laser industry Sleeer, 998 as well as of medical devices Chatterji, 006. However, the roortion of such entrants was significantly lower 8% in ISM vs. 6% in laser and 9% in medical devices. Two interesting atterns emerge from comaring the entry atterns of ISM with that of other industries. irst, many ISM firms about 0% have been founded by hackers. see table 3. Although such entry is virtually non-existent in other industries, it is not inconsistent with the view that in many industries lead users innovate, either to customize roducts or to fix roblems in them. Hackers ersonify what von Hiel 005 has dubbed the democratization of innovation, erhas a throwback to the tinkerers and inventors of the 9th century. Second is the virtual absence of sin-offs in the ISM relative to other or, instance von Hiel, 005 in his study found that nearly 50% of webmasters imlemented custom extensions to the security module of Aache web server.

23 industries. While in most manufacturing based industries, sin-offs constitute a big ercentage of all startus, only 6% of all entrants were startus. Overall, desite the ervasive nature of IT and non-manufacturing nature of the industry, the sources of entry in the ISM are surrisingly similar to other industries with two excetions: first, is the ossible excetion of hackers and second is the virtual absence of sin-offs. Yet, this excetion is consequential. An examination of the to 5 market leaders as identified by the InformationSecurity magazine in 007 in ISM suggests that diversifying entrants as well as hackers erform better relative to all other entrants, while none of the to erformers are sinoffs. Of the to 5 market leaders, 6 or about 40% were hacker founded startus. About a third are incumbent ICT trademarks diversifying into ISM. Both of the to technology suliers were startus that were founded by university rofessors. Table 4 ISM Market leaders irm name 007 sales Princial founder tye Main Market Network Associates $ Hacker Antivirus RSA Data Security $38.00 University Encrytion technology Symantec $5,87.30 Hacker Antivirus Checkoint $ Related startu irewall Comuter Associates $ Hacker Antivirus Cisco $ Diversifier irewall Aladdin $89.00 Hacker Authentication encrytion Junier $ Diversifier Network security encrytion Sybari $8.80 a Other Sam Certicom $5.0 University Encrytion technology Eeye security $.0 b Hacker irewall Secure comuting cor $76.70 Diversifier Authentication encrytion Internet Security Systems $39.80 Hacker irewall Entrust $38.00 Diversifier Authentication encrytion Trend Micro $68.90 Related startu Antivirus Source: Hoovers and Information Security magazine, Aril 007; +Security revenues calculated using Gartner s shiment data. a Was acquired by Microsoft for $6 billion in 003. The sales figure reresents estimated sales by hoovers in 007. b estimated sales in 007.

24 Timing of entry In many industries such as automobiles Kleer, 00 diversifying entrants were among the first to enter the ISM, while in certain other industries such as disk drives Christensen, 997, startus were among the first to enter. There do not aear to be big differences in the mean time of entry between startus and diversifiers. There are no significant differences between the timing of entry between different categories of startus, excet that related startus enter ISM later than both diversifiers and other startus. Relative to diversifiers, startus were not only smaller at the time of entry but they also entered the industry with fewer security atents. Table 5 shows that the internet stimulated the demand for information security, with over 80% 300 firms of a total of 343 firms of the firms entering after 995. The roortion of firms entering downstream segment also increased from just under 50% re-internet to nearly 66% ost-internet. Most of this increase is due to startus. Whereas re-internet, only 36% of the startus were downstream, ost-internet, 66% were downstream. In many manufacturing industries although startus constitute the major number of entrants, they are less successful Dunne et al., 988. This is true of ISM as well see table 6. Many revious studies rovide insights into the reasons for this suerior erformance. In some industries such as televisions, such erformance advantages are driven by suerior R&D caability Kleer and Simons, 000a. In other industries it is driven by suerior comlementary caability, secifically suerior sales and distribution caability medical imaging - Mitchell, 989; Disk drives King and Tucci, 00. Table 7 shows that diversifying entrants were not only larger at entry, but that they also had more security atents at entry. 3

25 Table 5 - Patterns of entry Before Ustream Downstream Both Total Ustream Downstream Both Total Diversifiers Related startus Other startus Hacker All startus Period Total Table 6 - Size, atents, trademarks at entry and mean time of entrants Diversifiers All Startus Related Hackers Unrelated Univ Startus Startus Log size at entry Log + sec. atents at entry Mean year of entry Log + IT trademarks Notes: Log of IT trademarks is not reorted for startus because startus do not have trademarks at the time of entry. Interestingly in the ISM, diversifying entrants are relatively more successful in the downstream segment selling only roducts suggesting that erhas such erformance advantages are due to suerior roduction or marketing and distribution caabilities see table 7. Also, the ISM seems be different from lasers in which sinoffs are successful. In the ISM, sinoffs do not erform as well as diversifying entrants. This is also the case with related startus as well. We exlore this further in our emirical analysis. Table 7 - Proortion of exits by market segment raw roortions Exits Downstream Both Diversifiers All startus Sinoffs Related Unrelated

26 Technology and roduct markets: As exlained earlier, firms in the samle were classified as technology suliers, roduct vendors or both. The technology markets are for encrytion, image matching, attern matching and single sign on technologies. The roduct markets consist of firewall, antivirus, authentication, encrytion, hardware, network security, sam control and consulting. In our emirical analysis, to conserve degrees of freedom, we consolidate roduct markets into those that use encrytion technologies, and those based on other technologies. The former consists of encrytion roducts, network security, and authentication, while firewalls, antivirus, sam control, hardware and consulting make u the other category. Our results are robust to inclusion of individual market secific fixed effects. Encrytion is by far the most atent intensive ISM technology Giarratana, 004. Roughly two thirds of all security atents related to encrytion technology. Encrytion markets are also more licensing intensive. Table 8 shows the number of atents er entrant and the number of licenses er entrant in ISM. There were almost three times as many licensing transactions er firm in encrytion markets relative to other markets. inally, for a subset of entrants, we were able to trace the source of technology. The last column in table 8 shows that whereas 65% of the entry in encrytion was based on licensed technology, the corresonding figure is only 3% for the other markets. Pre Table 8 Entry by submarket Total Security atents at entry Encrytion Other markets Licensing deals er firm Ustream ure licensors % entrants with licensed technology

27 5. Emirical results: In order to test hyotheses that relate to how markets for technology condition entry and exit, we exloit the variation across segments encrytion based and non-encrytion based as well variation over time, in the number of secialized licensors. Our benchmark secification uses the number of secialized licensors as a roxy for the extent of cometition in the market for technology, and roughly corresonds to b in the theoretical model. Strictly seaking the number of secialized licensors is endogenous. In our data, virtually all of these are the results of university invented technology being licensed by a startu. University invention may itself be related to characteristics of the underlying technology that are, in turn, related to conditions of entry and exit. We address this concern by using a tye of difference-in-difference strategy to identify the imact of interest. or instance, in a number of our hyotheses, markets for technology affect different tyes of entrants differentially. By stressing these differences in addition to the main effect, we can be more confident that what we see is the hyothesized effect, rather than merely unobserved differences across market segments. Entry strategy We first test the hyotheses related to entry strategy. We use a logit secification in which, the deendent variable downstream, takes a value of if an entrant entered the downstream segment. We use an encrytion market dummy to control for unobserved differences across encrytion based markets and others. We distinguish between the tyes of entrants. We use the log of +IT trademarks as a roxy for the amount of marketing assets of a firm while we use log +Size as a roxy for scale. Both these variables measure the extent to which, firms can efficiently roduce and sell ISM roducts. We also use the log of the citation 6

28 weighted number of security atents to control for technical cometence. 3 In addition we also control for age and age squared of the industry and timing of entry whether entry was before or after internet. Table 9 shows the results. The key indeendent variable is the number of technology suliers, log+tech. suliers. As noted before this variable varies both between market tye, namely encrytion vs. non-encrytion and also over time. 4 Secification shows that the number of IT trademarks held by firms at entry is associated with higher roortion of entry into the downstream segment. A % increase in the number of IT trademarks is associated with about a.9 times higher robability of entering downstream segment. Secification additionally shows that for size of the firm at time of entry itself increases the conditional robability of downstream entry. 5 A % increase in size is associated with about a % higher robability of entering downstream segment. urther the ICT dummy in secification suggests that diversifying ICT firms are about.8 times more likely to enter downstream segment relative to startus. These findings are consistent with the first rediction, namely that, firms with larger scale, and higher roduction and marketing caability are more likely to enter downstream, conditional on entry. These results are consistent with Gambardella and Giarratana 006. By a symmetric argument, these results also suggest that insofar as startus are less efficient, lacking scale and marketing assets, startus are more likely to enter technology markets Arora and osfuri, 003. The coefficient estimate of log+ security atents is negative and significant. This result also suorts the argument that atents 3 Since startus have no comlementary assets at the time of entry, this variable takes a value of 0 for startus. 4 About 6 firms do not reort size at the time of entry. We start by not controlling for scale, thereby using all 36 observations. In secification we additionally control for scale along with all the indeendent variables as in secification. However while doing so we lose about 6 observations that relate to firms that do not reort number of emloyees. 5 Note that we lose 4 observations for which size at entry is not observed in secification. 7

29 mediate technology sale, and thus encourage firms to also license their technology Arora and Ceccagnoli, 006. Result had imlied that an increase in cometition in market for technology increases the roortion of entry into the downstream segment. Secifications through 3 show that the number of secialized technology suliers increases the roortion of downstream entry. rom secification, a 0% increase in the number of technology suliers is associated with a 95% higher robability of downstream entry. This is consistent with entry by licensing in technology. In secification 4, we exlore if the resence of markets for technology encourages entry through licensing as imlicit in our model. If so, this should be reflected in how technology markets affect the entry of firms without technology. To this end, we divide all entrants into those with at least one security atent at the time of entry and those with none. It is lausible that firms with at least one atent are much more likely to ossess technology than those without a atent. We run two searate logistic regressions, one on a samle of firms that at least one atent at the time of entry and another on a samle of firms that had no atents at the time of entry. 6 6 We use two searate regressions in view of the otential roblems with interaction terms in nonlinear regression models Ai and Norton,