This survey of literature in software economics tries to find explanations for the vulnerabilities left in commercial software products and the lack of security considerations in software and information systems (IS) that are developed from components. An examination of the information economic environment where market-driven software development occurs, which is characterized by network effects and lock-in, suggests that the schedule and the budget constraints on secure software and IS development are outcomes of rational economic behaviour. The consequences for security of first-to-market competition (e.g. shortening development-cycle, release-oriented development, beta testing) and customer lock-in (e.g. into an insecure product) are considered from an economic point of view.