Comparing the Cybersecurity Risk Disclosures of U.S. and Foreign Firms

Abstract

ABSTRACTThis study explores the cybersecurity risk disclosure differences between foreign firms listed in the U.S. and U.S. firms. We first extract cybersecurity risks disclosures text with a Python program based on a list of cybersecurity keywords. We then perform textual analysis of the cybersecurity risk disclosures in foreign firms' 20-F filings and U.S. firms' 10-K filings. During our study period, we observe that foreign firms disclose more about their cybersecurity risks and their disclosures are more readable than U.S. firms. Foreign firms also use more numbers, fewer uncertainty words and fewer litigious language than their U.S. counterparts. In general, our study suggests that cybersecurity risk disclosures made by foreign firms are clearer and more specific than those made by U.S. firms. This finding could have implications for disclosure regulation and home bias research.