It may also be good to look at 'The market for silver bullets' (2008) [1]. This discusses security products as products where both the seller and buyer do not know enough to judge the efficacy of security products. Also where the cost of a breach may be far lower than the PR costs and fallout for example.