Characterizing Cybersecurity Threats to Organizations in Support of Risk Mitigation Decisions

Abstract

ABSTRACT:This study characterizes the cybersecurity threats experienced by organizations. Today's organizations face difficult decisions regarding the mitigation of cybersecurity threats. Taking different types of cybersecurity threats—physical, human, communication and data, and operational—this study applied topic modeling techniques on textual data gathered from 10-K reports of 87 organizations. A cluster analysis on the resultant topic weights showed three different clusters of organizations which were used to characterize the cybersecurity threats. Specifically, organizations in the manufacturing sector prioritized physical threats, whereas those in the information technology and finance sectors accorded greater importance to human, communication and data, and operational threats. This study offers preliminary characterization of cybersecurity threats that can be beneficial for organizational decision-makers. Implications for research and practice are discussed.