Disclosure of Cybersecurity Investments and the Cost of Capital

• 成果类型: Article; Early Access
• 署名作者: Havakhor, Taha; Rahman, Mohammad S.; Zhang, Tianjian
• 署名单位: McGill University; Purdue University System; Purdue University; California State University System; California State University Dominguez Hills
• 刊物名称: INFORMATION SYSTEMS RESEARCH
• ISSN/ISSBN: 1047-7047; 1526-5536
• DOI: 10.1287/isre.2023.0260
• 发表日期: 2026-04-20
• 关键词: disclosure; cybersecurity investment; cost of capital; informativeness of disclosure; ANALYST COVERAGE; research-and-development; information-technology; Security investments; SOCIAL PERFORMANCE; firm; earnings; recommendations; RISK; management; analysts

摘要

Despite investor interest and continued encouragement of transparency by regulators, firms generally adopt a private stance and refrain from disclosing investments in cybersecurity countermeasures. Existing literature suggests that firms may lack sufficient incentives to offset the potential risks of such disclosures. Thus, in the absence of clear evidence capturing robust benefits, firms may remain disincentivized to disclose their cybersecurity investments. Using exogenous shocks triggered by the U.S. Securities and Exchange Commission comment letters, this study investigates one strong incentive for disclosure: improved access to capital. We find that firms disclosing cybersecurity investments experience a significant reduction in their cost of accessing debt and equity capital and thus in their overall cost of capital. Further, we unravel the information intermediation process that is activated by signals sent through cybersecurity investment disclosures and leads to subsequent easier access to capital. Specifically, we show that disclosing firms with fewer boilerplate statements, that is, more informative ones, and those with higher analyst coverage or institutional ownership reap the highest benefits. Consistent with an information intermediation mechanism, which involves further information discovery by intermediaries, we demonstrate that actual investments in cybersecurity also strengthen the link between disclosure and cost of capital. This study reveals a robust and stable financial benefit of transparency in cybersecurity management, which transcends the transitory and sentimental short-term price variation impacts. This discovery encourages firms to proactively disclose their investments and mitigate information asymmetries related to their cybersecurity activities in an increasingly risky environment.