Does cybersecurity risk stifle corporate innovation activities?

Abstract

Cybersecurity risk has become a major concern for organizations due to its potential impact on a variety of corporate activities. This paper examines the impact of cybersecurity risk on corporate innovation activities and uncovers two important channels: risk-taking and precautionary savings. Employing textual analysis and machine learning techniques to estimate firms' ex-ante cybersecurity risk for a sample of U.S. listed firms, we show that cybersecurity risk is negatively related to corporate innovation. We address potential endogeneity biases and find the results to remain unchanged. Furthermore, our results are robust to alternative proxies, truncation issues, and external cybersecurity risk. We uncover the mechanisms underlying the main result by showing that the effects are more pronounced for firms with lower tolerance to risk and lower cash savings. Innovations of smaller, financially constrained firms and firms belonging to high cybersecurity risk and technology-intensive industries are affected more.