Abstract: An investment game theoretic model was presented to study the externality in firms′ network security investment with different investment costs and profits.Taking virus contagion as an example, the negative investment externality exerted by the contagion between firms in the network was investigated. Under such an environment, the investment threshold and factors concerned such as contagion probability and the number of investing firms were computed to determine several Nash equilibrium solutions with externality representing the risk. The model was analyzed further when the risk was endogenous and the invest threshold was much more complicated than that in exogenous environment. This endogenous threshold is determined not only by the probability of contagion between firms but also by the sign and absolute value of externalities. This method provides a novel viewpoint to information security risk management and advices for firms′ decision on security investment and government policies to induce investment under externality.