Cybersecurity and executive compensation: Can inside debt-induced risk aversion improve cyber risk management effectiveness?

Abstract

This study contributes to the emerging literature on the determinants and the consequences of cyberattacks by examining the impact of inside debt compensation on a firm's likelihood of experiencing a cyberattack and on attacked firms' cash holdings, R&D investments, and asset tangibility. We provide compelling evidence that inside debt compensation reduces the probability of experiencing a cyberattack. Furthermore, we document that high inside debt CEOs reduce their firm's cash holdings while they increase R&D investments and asset tangibility once their firms experience a hacking incident. These effects persist for three years after the attack. Our results are robust to alternative measurements of inside debt compensation and after accounting for potential sample selection and endogeneity concerns. Our findings underscore the importance of inside debt compensation as a governance mechanism that alleviates inefficiencies related to cybersecurity investments.