Disclosure of Cybersecurity Investments and the Cost of Capital

While firms have been steadily making cybersecurity investments, only a tiny fraction discloses information about such investments. This is puzzling because an informed market must reward firms that are reducing risks by managing security well and informing the market through regulatory disclosures. While anecdotes support such incentives, arguably, the lack of concrete evidence establishing the value for firms tied to cybersecurity investment disclosures perpetuates such behavior. Consequently, this study uncovers an important incentive for disclosures by answering: are financial markets efficient enough to reward disclosures of cybersecurity investment by reducing the firm’s cost of capital? We utilize exogenous variations in SEC comment letters, which shift a firm’s disclosure activity randomly, and find that one standard deviation increase in disclosing cybersecurity investments in SEC filings reduces the cost of capital by 7%. The effect is stronger for more informative disclosures, firms with more analysts followers, firms that are more likely to be invested by institutions, and when firms raise capital. The effect vanishes when either the investment or disclosure is inadequate. The findings highlight the role of reducing information asymmetry in connecting voluntary disclosures of cybersecurity investments with financial advantages.