Cybersecurity Investments and the Cost of Capital

We examine a potential path to value-creation by cybersecurity investments: a reduction in a firm's cost of capital. Building on the existing literature on corporate finance, we suggest that given the business-ending threats of cybersecurity incidents and the importance of cybersecurity investments to the future well-being of the firm, disclosing cybersecurity investments in proper channels of communication with investors (e.g., in Security and Exchange Commission, SEC, filings) likely reduces information asymmetries surrounding a firm's fundamental risks and leads to the investors' lowering the premiums charged on the borrowed capital. Empirically, we find that disclosing cybersecurity investments are associated with: a) a reduction in cost of capital (but not a reduction in operational costs, as expected in case of general IT investments), and b) a generally positive value as evidenced by robust, book-keeping measures of performance such as returns on assets and sales. Additionally, we show that both informativeness of the disclosure and the extent of the firm's analysts' coverage strengthen the cybersecurity investment and cost of capital link. Thus, this study establishes that the value of cybersecurity investments extends beyond their preventive benefits and limited market reactions and clarifies an important underlying mechanism through which cybersecurity investments create business value