Do lenders price firms’ cybersecurity risk?

Abstract

Firms are increasingly exposed to cybersecurity risk. Using syndicated loan data covering US firms, we examine how lenders price firms’ ex-ante cybersecurity risk. Our findings indicate that lenders charge, on average, a 4 to 13 basis points higher loan rate when a firm exhibits greater cybersecurity risk over time. Furthermore, we document that the pricing of cybersecurity risk differs between lender types. Commercial banks tend to adopt a more stringent approach to pricing cybersecurity risk compared to non-bank lenders. They also attach more financial covenants as firms become riskier. Even within commercial banks, the pricing of cybersecurity risk is primarily driven by lenders who show awareness of their own cybersecurity risk and have considered an insurance policy. These findings highlight the importance of lender awareness in pricing borrower risks, especially for risks that are not typically assessed in standard evaluations. Lastly, purchasing cybersecurity insurance does not mitigate higher loan spreads for borrowers.