Journal of Operational Risk

Risk.net

Ex-intrusion corporate cyber risk: evidence from internet protocol networks

Bill B. Francis, Wenyao Hu and Thomas D. Shohfi

  • A large and representative sample of cyberattacks shows diminished negative equity and insignificant corporate bond market returns compared to prior studies with smaller, economically biased samples.
  • Stockholders and creditors incorporate external Internet protocol (IP) network size, measured using registrations from the American Registry for Internet Numbers (ARIN), into firm value.
  • Debt and equity market reactions to cyberattacks are further mitigated for firms with ARIN registrations and larger external IP network footprints.
  • Overall, cyber-risk is priced before successful cyberattacks and we identify an important metric to evaluate said risk.

Previous event studies of corporate cyber risk have been limited to successful attacks on public firms, but the samples are biased because they are based on the economic magnitude of equity losses. To address this selection bias, we construct a larger and more representative sample of cyber intrusions only, finding diminished negative equity (insignificant corporate bond) market reactions compared with these prior studies. To identify cyber risk irrespective of observing successful attacks, we match public firms with internet protocol network data from the American Registry for Internet Numbers between 1991 and 2017. We find that both stockholders and creditors incorporate external internet protocol network size into the firm value. Further, debt and equity market reactions to cyber attacks are mitigated for firms with registered internet protocol networks and larger network deployments. Overall, our study reveals an important public data source that can help institutions proxy for and more accurately price firms’ cyber security risks.

To continue reading...

You need to sign in to use this feature. If you don’t have a Risk.net account, please register for a trial.

Sign in
You are currently on corporate access.

To use this feature you will need an individual account. If you have one already please sign in.

Sign in.

Alternatively you can request an individual account here: