ABSTRACT The vigorous development of Internet information technology has brought a lot of convenience and fun to people's lives. However, in the modern information world, the problem of information security has always existed. Given the prevalence of information security problems and their consequences, enterprises often invest in information security technologies to strengthen their information systems. However, the security vulnerabilities of information systems cannot be eliminated, so the choice of investment strategies by enterprises is of great significance. Based on the evolutionary game method, this study analyses, from a microscopic perspective, the investment strategy selection process of enterprises when there are security vulnerabilities in information system in the context of the complementarity of information assets between enterprises, and simulates the impact of enterprises' initial investment intention and potential losses as well as breach probabilities and cost differentials on the evolutionary outcomes. The research shows that an enterprise is more willing to choose an investment strategy that minimises the sum of investment costs and expected losses. The higher the enterprise's initial high investment intention or potential losses, the more likely it is to choose a high investment strategy, whilst its partner enterprise is less likely to choose a high investment strategy. In addition, when security investments effectively reduce breach probabilities, enterprises are more inclined to adopt high‐investment strategies, whilst higher hacker operational costs can help alleviate enterprises' security investment pressure.