Does cyber risk exposure, as opposed to actual incidents, affect firm outcomes?
This paper employs computational linguistics to introduce a novel text-based measure of firm-level cyber risk exposure based on quarterly earnings conference calls of listed firms. Our quarterly measures are available for more than 13,000 firms from 85 countries over 2002-2021. We document that cyber risk exposure predicts cyber attacks, affects stock returns and profits, and is priced in the equity option market. The cost of option protection against price, variance, and tail risks is greater for more cyber-exposed firms. Cyber risks spill over across firms and persist at the sectoral level. The geography of cyber risk exposure is well approximated by a gravity model extended with cross-border portfolio flows. Back-of-the-envelope calculations suggest that the global cost of cyber risk is over $200 billion per year.
