This isn't new news, or at least it shouldn't be, but Eli Dourado presents the logic pretty nicely in a Mercatus working paper. I'm likely to pick this one up for the week on externality in my Economics and Current Policy Issues class; the first section gives a lucid and tractable exposition of the basic theory I try to get through to students in lecture. We're both fans of Buchanan and Stubblebine's approach. Here's Eli:
Once again, when externalities are internalized in a complex fashion through firms and other transaction-cost-reducing arrangements, the visible external harm or benefit will often persist. We still observe external benefits from lighthouses and, at least in jurisdictions that still allow smoking in bars, we still observe nuisance externalities generated by smokers. But these are not market failures; these are problems that the market has solved despite the high transaction costs that plague the primary actors.Market failure results from gains from trade that fail to obtain due to some impediment; alert entrepreneurs view such impediments as profit opportunities for those who are able to innovate around the blockage.
And Eli's extension to cybersecurity makes points that get missed by cybersecurity experts.