This paper examines the dispersion in cybersecurity risk across firms. Using new, proprietary data on the Fortune 500 firms, We show that higher productivity firms exhibit abnormal returns. We subsequently document three new facts: (a) higher productivity firms have fewer cybersecurity...

Using textual analysis and comparing cybersecurity-risk disclosures of firms that were hacked to others that were not, we propose a novel firm-level measure of cybersecurity risk for all US-listed firms. We then examine whether cybersecurity risk is priced in the cross-section of stock returns....

We develop a novel firm-level measure of cybersecurity risk using textual analysis of cybersecurity-risk disclosures in corporate filings. The measure successfully identifies firms extensively discussing cybersecurity risk in their 10-K, displays intuitive relations with quantitative measures of...