With the widespread application of the Internet of Things(IoT)technology and the popularity of smart products,issues related to cybersecurity and user data privacy have garnered widespread societal attention,making it crucial for governments to adopt appropriate regulatory strategies to mitigate cybersecurity risks.This paper considers a smart product supply chain composed of a manufacturer and an e-tailing platform.A game-theoretic model was employed to investigate the government's regulatory strategies(punishing or subsidizing)and its impact on firms and consumers under cybersecurity risks.The findings indicate that the cyber defense level under the subsidizing policy is higher than that under the punishing policy only when the subsidy ratio is significantly high;both punishing and subsidizing policies can achieve an all-win situation for the manufacturer,the platform,and consumers,contingent on two parameters:the marginal information value and the unit penalty;moreover,the government should choose the punishing policy when both the marginal information value and the unit penalty are high,and choose the subsidizing policy when either the marginal information value or the unit penalty is low.It is found that both high penalties and subsidies are beneficial to societal welfare.This research provides a theoretical basis and policy implications for government regulation,emphasizing the need to consider various influencing factors when choosing regulatory strategies to foster the healthy development of the smart product supply chain and enhance cybersecurity levels.