Cybersecurity Risk

Abstract

Using textual analysis and comparing cybersecurity-risk disclosures of firms that were hacked to others that were not, we propose a novel firm-level measure of cybersecurity risk for all USlisted firms. We then examine whether cybersecurity risk is priced in the cross-section of stock returns. Portfolios of firms with high exposure to cybersecurity risk outperform other firms, on average, by up to 8.3% per year. At the same time, high-exposure firms perform poorly in periods of high cybersecurity risk. Reassuringly, the measure is higher in informationtechnology industries, correlates with characteristics linked to firms hit by cyberattacks, and predicts future cyberattacks.