Do Financial Markets Understand Cybersecurity: Evidence from a Direct Measure of Firm Network Vulnerabilities

Abstract

Despite the growing importance of cybersecurity, identifying exposures using publicly available information has proven challenging. We introduce a novel firm-level measure of cybersecurity exposures that counts the number network ports accessible from the public internet. Our process replicates “port scans,” a technique hackers implement to identify vulnerable firms. We find that cybersecurity exposures predict future realized breaches. High cybersecurity exposure stocks underperform other stocks by 0.42% per month, equivalent to a $87mm loss for the median market value sample firm. Our study highlights the cost of cybersecurity exposures and provides guidance to managers and investors in identifying potential exposures. 

Keywords: Abnormal Returns, Cybersecurity, Data Breaches JEL Codes: G12, G14, G41, H23, H56

JEL Classification: G12, G14, G41, H23, H56