Cybersecurity Risk: The Data

Abstract

In our paper “Cybersecurity Risk” (Florackis, C., Louca, C., Michaely, R. and M. Weber. 2023. The Review of Financial Studies, Volume 36, Issue 1, Pages 351-407; https://doi.org/10.1093/rfs/hhac024) we construct a novel firm-level measure of cybersecurity risk using textual analysis of cybersecurity-risk disclosures in “Item 1A. Risk Factors” section of 10-K statements. The measure successfully identifies firms extensively discussing cybersecurity risk in their 10-K, displays intuitive relations with quantitative measures of cybersecurity risk disclosure language, exhibits a positive trend over time, is more prevalent among industries relying more on information technology systems, correlates with several characteristics linked to firms hit by cyberattacks and, importantly, predicts future cyberattacks. After providing evidence that our measure captures exposure to cybersecurity risk, we show that cybersecurity risk is priced in the cross-section of stock returns. Here, we publicly release our measure and hope that this allow for more subtle investigations and spur new research in this area.