Economic Perspective on Cybersecurity Investments: Cyber-Insurance and the Stock Market Value of Firms

Abstract

Cybersecurity has gained prominence in the decision-making of countries and firms alike. Cyber incidents can in fact result in operational disruption of businesses and institutions with ensuing relevant losses and recovery costs. The literature has extensively studied how stock markets react to the news of a cyber incident affecting a listed company. Empirical findings show that a cyber incident announcement is generally followed by a drop in the market value of the affected firm. Some studies consider this reaction as driven by specific characteristics of the breached firms, such as their size or sector of activity. Recently, insurance against cyber risk has gained relevance as a tool for risk management, however the analysis of the interaction between the cyber-insurance market and the equity market has been left unexplored. This paper fills the gap by discussing the role of cyber-insurance within a game between firms and investors. A set of hypotheses is derived and empirically tested.