This paper examines how governance and risk management affect risk-taking in banks. It distinguishes between good risks, which are risks that have an ex ante private reward for the bank on a stand-alone basis, and bad risks, which do not have such a reward. A well-governed bank takes the amount...

We develop a model where a firm has an optimal exposure to cyber risk. With rational, fully informed agents and with no hysteresis, a successful cyberattack should have no impact on a financially unconstrained target's reputation and post-attack policies. In contrast, when a successful attack...