Abnormal Returns and Dispersion in Cybersecurity Exposure

Abstract

This paper examines the dispersion in cybersecurity risk across firms. Using new, proprietary data on the Fortune 500 firms, We show that higher productivity firms exhibit abnormal returns. We subsequently document three new facts: (a) higher productivity firms have fewer cybersecurity vulnerabilities, (b) vulnerabilities are highly persistent within-firm, and (c) vulnerabilities are associated with data breaches. Our results suggest that higher productivity firms gain access to more technical human capital resources that are capable of mitigating cybersecurity vulnerabilities.