Does cybersecurity risk stifle corporate innovation activities?

Cybersecurity risk has become a major concern for organizations due to its potential impact on a variety of corporate activities. This paper examines the impact of cybersecurity risk on corporate innovation activities and uncovers two important channels: risk-taking and precautionary savings. Employing textual analysis and machine learning techniques to estimate firms' ex-ante cybersecurity risk for a sample of U.S. listed firms, we show that cybersecurity risk is negatively related to corporate innovation. We address potential endogeneity biases and find the results to remain unchanged. Furthermore, our results are robust to alternative proxies, truncation issues, and external cybersecurity risk. We uncover the mechanisms underlying the main result by showing that the effects are more pronounced for firms with lower tolerance to risk and lower cash savings. Innovations of smaller, financially constrained firms and firms belonging to high cybersecurity risk and technology-intensive industries are affected more.

Automated summary

This paper examines the impact of cybersecurity risk on corporate innovation and finds that risk-taking and precautionary savings are two important channels through which cybersecurity risk affects innovation activities. By using textual analysis and machine learning techniques on a sample of US-listed firms, the study shows a negative relationship between cybersecurity risk and corporate innovation. The results remain robust even after addressing potential endogeneity biases. It is further revealed that firms with lower risk tolerance and lower cash savings are more affected, especially smaller financially constrained firms operating in high cybersecurity risk and technology-intensive industries.