Cybersecurity Investment Research Articles

The Finance of Cybersecurity: Quantitative Modeling of Investment Decisions and Net Present Value

Despite the growing literature on cybersecurity investment, significant gaps remain unaddressed. First, the existing literature does not differentiate between cybersecurity expenditures, namely investment versus spending, despite the differences in their financial treatments. Second, the literature predominantly employs economic and risk-based models, in which the incorporation of financial parameters is limited. Third, the literature focuses on quantifying market (stock) loss of cyberattacks or conducting a cost-benefit analysis of cybersecurity investments but has yet to bridge these two areas. Thus, our objective is to introduce a new financial model, the Alpha Model, that addresses these gaps. We first provide distinctions between cybersecurity investment (capital expenditure) and spending (operational expenditure). Grounded in Relative Valuation Models and Optimal Capital Structure Theory, we quantify the upper-bound of optimal cybersecurity investment by utilizing book and market values of equity and debt. We also demonstrate that the Net Present Values (NPV) of cybersecurity investment is considerably lower than its book value by incorporating financial parameters of equity and debt financing, inflation-adjusted capital cost, and tax credits of depreciation and interest. To validate our model, we empirically test it by using data from the S&P500 index during 2018–2023. We offer practical implications to key stakeholders, including: (1) industry executives to financially quantify cybersecurity investments and ascertain their actual NPVs, individually and collaboratively with supply chain partners; (2) cybersecurity solution providers to promote business investments in cybersecurity; and (3) insurance providers to price premiums with higher NPVs than the corresponding investments. We also offer several avenues for further research.

Navigating cybersecurity challenges: Legal implications and organizational strategies

The increasing frequency and sophistication of cybersecurity incidents—such as data breaches, ransomware attacks, and system violations—highlight significant legal and organizational challenges. Despite rising investments in cybersecurity, these incidents continue to evolve, presenting complex issues for both corporations and regulators. Traditional legal frameworks, primarily focused on financial damages, fail to address non-financial harms like emotional and psychological impacts on consumers. Studies by Teichmann and Wittmann (2022) and Kilovaty (2021) reveal gaps in current cybersecurity laws, emphasizing the need to incorporate psychological damages and enhance corporate liability standards. Research by Frank, Grenier, and Pyzoha (2021) demonstrates the increasing litigation risks for boards of directors following cybersecurity incidents. Their findings suggest that prior cyberattacks raise the likelihood of being held liable, though implementing frameworks like the American Institute of Certified Public Accountants’ (AICPA) risk management guidelines can mitigate these risks. Additionally, Eijkelenboom and Nieuwesteeg (2020) analyze the disclosure of cybersecurity information in Dutch annual reports, finding a lack of transparency despite legal requirements. Their study underscores the need for better self-regulation or potential legal mandates to improve cybersecurity reporting. Falowo et al. (2022) examine the impact of digital interconnectedness on cybersecurity risks, noting that malware and phishing attacks are prevalent. Their research highlights the importance of organizational preparedness and adherence to frameworks such as the National Institute of Standards and Technology (NIST) guidelines for effective incident response. Sen (2018) identifies ongoing technical, economic, legal, and behavioral challenges that hinder effective cybersecurity, advocating for new strategies to overcome these barriers. Overall, enhancing cybersecurity resilience requires a comprehensive approach, integrating improved legal frameworks, organizational transparency, and proactive risk management.

The Urgency of Stakeholder Cyberspace Collaboration to Support Indonesia’s National Defense

In today's interconnected digital world, stakeholder collaboration in cyberspace is crucial for national defense. Advances in information and communication technology have transformed daily life but also introduced complex cyber threats like cyber warfare, cybercrimes, and cyber terrorism, challenging security and stability. The objective of this study is to emphasize the importance of collaboration among diverse stakeholders in enhancing national defense against cyber threats. The methodology involves analyzing existing literature and case studies to understand the impact of collaboration on cybersecurity maturity and national defense strategies. The research findings, derived from SWOT and PESTLE analyses, have highlighted the strengths and weaknesses in collaboration, underscoring the significance of leveraging strengths and addressing weaknesses to establish a robust defense framework. To enhance national defense against cyber threats, a holistic approach is essential, combining political collaboration, economic partnerships, social awareness programs, technological advancements, legal harmonization, and environmental resilience strategies. Key recommendations include fostering regular communication among stakeholders, pooling resources for cybersecurity investments, promoting cybersecurity education, integrating advanced technologies like AI and IoT security solutions, and aligning legal frameworks across jurisdictions.

CYBERATTACKS ON THE ACCOUNTING PROFESSION :A LITERATUR REVIEW

This research reviews the literature on cyberattacks against accounting information systems, focusing on their causes, impacts and mitigation strategies. The results of the systematic mapping show that cyberattacks are caused by various internal and external factors, including system vulnerabilities, human error, and technological evolution. The impact of cyberattacks can be significant, including financial loss, reputational damage, compromise of financial data, erosion of trust, and operational disruption. Addressing these challenges requires a proactive approach that combines technology, policy and education. Investment in cybersecurity, awareness training, and a strong security culture are essential to mitigate cyber risks. Further research is needed to evaluate the effectiveness of cybersecurity strategies, the role of cybersecurity culture, rapid detection and response methods, integration of new technologies, and the impact of regulations. By raising awareness and implementing proactive measures, the accounting profession can improve its cybersecurity posture and protect critical financial information from cyber threats.

Cybersecurity investments in supply chains with two-stage risk propagation

Cyber-attacks present a significant threat to supply chains as their nodes are directly or indirectly vulnerable to risk propagation at various stages. The risk level varies depending on the type of attack. A cybersecurity insurance offers a practical method to mitigate this risk, and it is crucial to determine optimal cybersecurity investments for all supply chain nodes. Previous studies have overlooked the joint impact of the attack type, two-stage risk propagation, and cybersecurity insurance in optimizing cybersecurity investments. This paper addresses this research gap by examining optimal investments under targeted and opportunistic attacks in a two-stage supply chain using game theory. The findings indicate that optimal investments differ based on the type of attack. For instance, retailers should invest more in cybersecurity under opportunistic attacks, while suppliers need to spend more under targeted attacks. Additionally, the results show that under opportunistic attacks, members should reduce their investments. Conversely, under targeted attacks, investments should initially increase and then stabilize. In the case of opportunistic attacks, suppliers and retailers should prioritize reconfiguring their systems over investing heavily in cybersecurity. The model presented in this paper demonstrates that not all cyber risks are worth defending against and that cybersecurity insurance for the entire supply chain can be more cost-effective than addressing cybersecurity risks individually. The paper also explores the impact of joint decisions on cybersecurity insurance when firms are unwilling to invest individually. The insights obtained enable supply chains to identify their optimal cybersecurity investment strategies effectively.

THE IMPACT OF E-COMMERCE ON OPERATIONAL COST EFFICIENCY IN MODERN BUSINESSES

This study explores the impact of e-commerce on operational cost efficiency in modern businesses. E-commerce platforms enhance cost savings through advanced inventory management, streamlined supply chain processes, and reduced overhead. Key findings include improved inventory control with real-time tracking, lower transportation costs via direct-to-consumer models, and significant savings on physical retail space expenses. Additionally, digital marketing strategies offer cost-effective advertising solutions. Challenges include the need for investment in IT infrastructure and cybersecurity. Strategic investments and continuous innovation are crucial for maximizing e-commerce benefits.

Navigating through cyberattacks: The role of tax aggressiveness

This research investigates the impact of cyberattacks on tax aggressiveness using a difference-in-differences analysis with a matched sample. We find that firms experiencing cyberattacks are more likely to have lower cash effective tax rates and greater discretionary book-tax differences. We further show that cyberattacks have a greater impact on corporate tax aggressiveness when firms are more exposed to financial distress. Additional analyses show tax aggressiveness increases less when firms are in states with enactments of notification laws and firms with ex ante higher cybersecurity investment. Our aggregate results suggest that firms take more tax risky positions in response to greater financial distress and information asymmetry, which are attributed to the consequences of cyberattacks.

A quality managerial approach on the relationship between the digital development level and the cyber security index

The main goal for the realization of this study was to verify the level of relations between digitalization and cyber security. The path followed for the realization of this study was the creation of the idea for the study and the relationship between the issues that were considered, the search for the most appropriate and freshest literature, the collection of data for this study, the raising of hypotheses, the processing of data and performing the regression analysis, extracting the results, verifying the main hypothesis, and from them reaching the relevant conclusions and recommendations. The main recommendation of this study is that investment in digitalization also affects investments in cyber security and both together help the development of countries and their integration between each other and beyond, while the relations between digitalization, cyber security and quality management are embodied at ISO standards, especially at ISO 38500, and ISO 27000 family of standards.

ECONOMIC OF CYBER-SECURITY AND SOCIETY DATABASES: PROTECTING THE DIGITAL ECOSYSTEM FROM CYBER-ATTACKS

Objective: The objective of this study is to explore the role of investment in cybersecurity and the enhancement of the digital ecosystem. Theoretical Framework: In this topic, the main concepts and theories that under in the research are presented. Therefore, the article sheds light on the importance of taking effective measures to preserve cybersecurity and promote the digital environment. The analysis focuses on three key pillars: the digital ecosystem, the economic impact of cyberattacks, and the role of investment in strengthening cybersecurity. Method: The method of this study is data descriptive from Statista 2023 datatbases. We have relied on this method because it is suitable for analyzing available data and statistics regarding cyberthreats and their impact on the economy and society. This method has enabled us to analyze results of reports and studies regarding cybersecurity and reach the most significant challenges facing institutions in enhancing safety and digital growth. Results and Discussion: The results obtained reveal several key findings. Most significantly, the study finds that investment in cybersecurity significantly enhances the ability to counter growing digital threats, such as electronic piracy and malware attacks. Research Implications: The practical and theoretical implications of this research are discussed, providing insights into how the results can be applied or influence practices in the field of the cybersecurity. These implications could encompass Firms, Organizations and individuals in our digital age (AI). Orginality/Value: The originality value of this research study suggested that the investment in cypersecurity can significantly contribute to building a sustainable economy, promoting safe practices in the digital environment, and creating new job opportunities.

Integrated model to optimize supplier selection and investments for cyber resilience in digital supply chains

Digitalization has revolutionized the supply chain networks but also introduces vulnerabilities to the cyber threats. Notably, in past two years, the cyber-attacks on different organizations worldwide have increased at an alarming rate resulting in significant financial loss to supply chains, intellectual property breaches and supply disruptions. As a result, companies are making significant investments in their cybersecurity. However, many incidents were reported where threat actors attacked a company using the shared digital systems with its suppliers. Therefore, it is important that suppliers are selected based on their cyber resilience. This paper identifies the cyber resilience criteria and proposed a multi criteria decision making based framework to evaluate the cyber resilience of a supply chain partner. It has been also realized that investment in organizational cybersecurity alone is not sufficient to protect supply chains. Companies are now investing in increasing their supply chain cyber capabilities. In this direction, paper also proposes a mixed integer linear program (MILP) to jointly optimize supplier selection and cyber investment decisions in a supply chain based on the supplier's current cyber resilience and potential return on the cyber investments made in selected suppliers. Computational experiments are conducted to study the tradeoffs and impact of sourcing strategy, supplier capacity, cyber security investment decisions on supply chain cyber resilience. The findings underscore that an integrated decision making of supplier selection and cyber investments maximizes the supply chain cyber resilience.

تحديد عائد الاستثمارات الأمنية للشركات التقنية الناشئة

تعتبر الشركات الناشئة في مجال التكنولوجيا بالغة الأهمية في النهوض بالمبادرات الرقمية في العديد من البلدان التي تخضع لأجندة الدولة الذكية. وبالتالي ، فإن الشركات الناشئة في مجال التكنولوجيا هي بائعون وموردون للخدمات للمنظمات الكبيرة مثل القطاع الحكومي والشركات متعددة الجنسيات والمؤسسات المالية. على هذا النحو ، أصبحت الشركات الناشئة سريعًا نواقل هجوم للجناة الخبثاء للدخول عبر الأبواب الخلفية إلى المؤسسات الكبيرة. ومع ذلك ، لا تزال الشركات الناشئة حكيمة في إنفاقها على الأمن السيبراني لأن نجمها الشمالي هو توليد الإيرادات من خلال تقديم خدماتها والحد الأدنى من المنتجات القابلة للتطبيق (MVP) لعملائها. تقترح هذه الدراسة عائدًا معززًا على الاستثمار الأمني (ROSI) والذي يساعد الشركات الناشئة في مجال التكنولوجيا على حساب العائد على الاستثمار الأمني وتبرير ميزانيتها للإنفاق على الأمن السيبراني على الرغم من وجود نماذج حالية لحساب عائد الاستثمارات المخصصة لنفقات الأمن السيبراني ، إلا أنها معقدة نوعًا ما ولا تعطي وضوحًا للإدارة من حيث القيمة النقدية للإنفاق على الأمن السيبراني. علاوة على ذلك ، لا تلبي النماذج الحالية ديناميكيات وفروق الشركات الناشئة في مجال التكنولوجيا. يوفر النموذج المحسّن أيضًا للشركات الناشئة في مجال التكنولوجيا القدرة على تعديل استثماراتها في مجال الأمن السيبراني بشكل مناسب بناءً على حسابات قيم الحد الأدنى (الأدنى) والحد الأقصى (الأقصى) لمؤشر ROSI. تم التحقق من صحة نموذج ROSI المقترح والمحسّن من قبل 5 من خبراء الأمن السيبراني الذين اتفقوا على أهمية وضرورة النموذج الذي سيتم تطبيقه على الشركات الناشئة في مجال التكنولوجيا. تتيح نتائج دراسة الحالة الخاصة بشركة FinTech الناشئة حساب Min و Max ROSI لتبرير العائد على الاستثمارات الأمنية وتزويد الشركة الناشئة بالقدرة على ضبط الإنفاق على الأمن السيبراني وفقًا لذلك.

CHINA'S ECONOMIC CYBER STRATEGY IN FACING ECONOMIC CYBER THREATS 2020 - 2023

Digital technology has succeeded in making it easier for a country to analyse data, development, improvement of a performance or product which is then included in a network. These advances in digital technology also have a risk impact on security issues. This research examines the cybereconomic strategy applied by China in dealing with the threat of economic cybers between 2020 and 2023. With the rapid growth of information technology, China faces significant challenges in ensuring its economic cybersecurity. This research analyses the steps taken by the Chinese government to address economic cyber threats, including increased regulation, investment in cybersecurity, and cyber diplomacy efforts. In this study the researcher uses a qualitative method. Qualitative method is a research or observational procedure that produces descriptive data that emphasizes the concept of a problem in research. The findings suggest that China has adopted a comprehensive and proactive approach to protecting its economic cybersecurity, although it still faces significant challenges. The implication of this research is the importance of technological innovation in overcoming economic cyber threats in the era of digital globalization.

HARNESSING ARTIFICIAL INTELLIGENCE FOR ADVANCED THREAT DETECTION IN NETWORK INFRASTRUCTURES

As cyber threats grow increasingly sophisticated, traditional security measures are falling behind in the face of these evolving attacks. This article highlights the role of Smart Sentinel, a cutting-edge threat detection system that utilizes Artificial Intelligence (AI) to strengthen network defenses. Unlike conventional security solutions, Smart Sentinel employs machine learning algorithms to continuously learn and adapt, enabling it to detect anomalies and potential threats in real-time. By analyzing a variety of data sources, including network traffic and user behavior, the system establishes a baseline of normal activity and continually enhances its threat detection capabilities. Key features such as anomaly detection, behavioral analysis, real-time response, and adaptive learning contribute to an improved security posture, reduced false positives, enhanced operational efficiency, and cost-effectiveness. Smart Sentinel represents a significant breakthrough in cybersecurity, providing organizations with a proactive and resilient defense against the ever-evolving cyber threat landscape. Key features such as anomaly detection, behavioral analysis, real-time response, and adaptive learning contribute to Smart Sentinel’s effectiveness in protecting organizations against cyber threats. Anomaly detection: Smart Sentinel identifies unusual patterns and activities that deviate from established norms, alerting security teams to potential threats. Behavioral analysis: Smart Sentinel goes beyond simply detecting anomalies by analyzing user and system behavior to identify suspicious patterns that may indicate malicious intent. Real-time response: Smart Sentinel’s real-time response capabilities enable it to take immediate action upon detecting a threat, such as isolating compromised systems, blocking malicious IP addresses, or generating alerts for human intervention. Adaptive learning: Through continuous monitoring and analysis, Smart Sentinel continuously learns and improves its ability to discern between normal and malicious activities, reducing false positives and improving overall security posture. Smart Sentinel’s impact on organizations is multifaceted: Enhanced security posture: Smart Sentinel proactively identifies and mitigates emerging threats, strengthening an organization’s overall security posture. Reduced false positives: Smart Sentinel’s adaptive learning capabilities minimize the number of false positives, preventing alert fatigue and allowing security teams to focus on genuine threats. Operational efficiency: Smart Sentinel automates routine tasks, freeing up security teams to focus on strategic initiatives and improve operational efficiency. Cost-effectiveness: Smart Sentinel optimizes cybersecurity investments by automating threat detection and response, reducing the need for costly manual intervention and minimizing the potential for financial losses from successful cyberattacks.

A perspective on three trade‐offs of blockchain technology for the global strategy of the MNC

AbstractResearch SummaryNew technology plays a key role in shaping the global strategy of the MNC. We propose a perspective on how and why a novel technological development—blockchain technology—and its relevant applications affect the global strategy of the MNC. We focus on the trade‐offs associated with cryptocurrencies, smart contracts, and blockchain data, and provide several real‐world examples. While cryptocurrencies could lower financial costs and broaden consumers' payment options, they require new investments in cybersecurity and payment infrastructure. Smart contracts could increase trust in collaboration due to their automated, transparent, and inflexible rules, but their rigidity can harm collaboration. Finally, while blockchain data can enhance the MNC's analytics capabilities, it can also jeopardize consumer privacy.Managerial SummaryIs blockchain technology all hype or a useful advancement for global firms? We propose that this technology has merits and drawbacks for financial transactions, collaboration, and data analytics. Cryptocurrencies have stolen the headlines and several leading organizations have already added them as payment methods. Their merits include lower transaction fees, better security, and higher speed, but they require expensive infrastructure and carry a stigma. Smart contracts can streamline agreements between parties but lack the flexibility that global firms need when interacting with suppliers and partners. Novel blockchain data can be plugged into marketing dashboards but can also threaten consumer privacy. Overall, the jury is still out on the role of blockchain technology for global firms.

Human factors in remote work: examining cyber hygiene practices

Purpose The purpose of this paper is to investigate the cyber hygiene practices of remote workers. Design/methodology/approach This paper used two instruments: first, the Cyber Hygiene Inventory scale, which measures users’ information and computer security behaviors; second, the Recsem Inventory, developed within this paper’s context, to evaluate the cybersecurity measures adopted by organizations for remote workers. It was conducted on remote workers to examine their information security practices. The instrument was administered to a sample of 442 employees reached via the LinkedIn platform. Analyses were performed with SPSS v26, Python programming language and Seaborn library. Findings The findings indicate a significant correlation between the security measures implemented by companies and their employees’ cyber hygiene practices. A sector comparison revealed a significant difference in cyber hygiene levels between public and private sector workers. Research limitations/implications This paper aims to provide policymakers with suggestions for enhancing the cyber hygiene of remote workers to facilitate compliance with corporate security protocols. Originality/value This paper’s conclusions highlight the importance of companies increasing their cybersecurity investments as remote work becomes more prevalent. This should consider not only corporate-level factors but also employees' information and computer security behaviors.

Integrating Enterprise Architecture into Cybersecurity Risk Management in Higher Education

Cybercriminals constantly seek new methods to infiltrate a company's defences, making cybersecurity investments essential. Enterprise architecture (EA) provides a systematic risk detection and mitigation process by emphasising the interdependencies between systems, data, processes, people, and other factors. This paper provides a comprehensive approach, also referred to as a process, based on EA to assist African universities in developing a comprehensive cybersecurity plan. The EA process comprises four pillars: business architecture, data architecture, application architecture, and technology architecture. African universities can develop a comprehensive cybersecurity strategy using an EA approach in cybersecurity to achieve institutional goals and objectives. The potential attack surface comprises isolated EA components and their interconnections.This article comprehensively examines various EA processes such as business, information, application, and technology architecture. These processes are carefully analysed to evaluate the organisational structures and uncover opportunities to enhance security protocols. Additionally, we delve deep into abstract security patterns, seeking to cultivate an environment of trustworthiness within complex systems. Our research findings underscore the significant potential within African higher education institutions. By embracing a model-based approach to risk analysis and mitigation, these institutions can fortify their cybersecurity defences to ensure uninterrupted business operations and enhance overall resilience in the face of evolving security challenges.When we combine EA and information security (ICS), we uncover many vulnerabilities malicious actors might exploit. By embracing a holistic EA-based methodology, institutions can craft and implement robust security protocols to safeguard their components and connections. Leveraging EA, our proposed integrated approach aims to forge a comprehensive cybersecurity risk management strategy tailored to the African higher education sector. This strategy seeks to facilitate the identification of critical elements and their intricate interrelationships, thus formulating an effective defence strategy against potential cyber threats. The synergy promises to elevate cybersecurity practices, ensure uninterrupted business operations, and fortify the continent's resilience.

Investigating the multifaceted dynamics of cybersecurity practices and their impact on the quality of e-government services: evidence from the KSA

PurposeThe Kingdom of Saudi Arabia (KSA) is embracing digital transformation and e-government services, aiming to improve efficiency, accessibility and citizen-centricity. Nonetheless, the country faces challenges such as evolving cyber threats. The purpose of this study is to investigate the factors influencing cybersecurity practices to ensure the reliability and security of e-government services.Design/methodology/approachThis paper investigates the multifaceted dynamics of cybersecurity practices and their impact on the quality and effectiveness of e-government services. Five key factors explored include organizational culture, technology infrastructure, adherence to standards and regulations, employee training and awareness and financial investment in cybersecurity. This study used a quantitative method to gather data from 320 participants. The researcher collected 285 completed questionnaires, excluding unusable or incomplete responses, and analyzed the final data set using partial least squares structural equation modeling.FindingsThe findings show that financial investment in cybersecurity, employee training and awareness and adherence to cybersecurity regulations significantly influence the adoption of robust cybersecurity practices. However, the relationship between organizational culture and cybersecurity practices is less straightforward. The research establishes a strong positive correlation between cybersecurity practices and e-government service quality, highlighting the role of security in fostering public trust and user satisfaction and meeting the evolving needs of citizens and businesses.Originality/valueThis research contributes valuable empirical evidence to the fields of e-government and cybersecurity, offering insights that can inform evidence-based policy decisions and resource allocation. By understanding the nuanced dynamics at play, Saudi Arabia is better poised to fortify its digital governance infrastructure and provide secure, high-quality e-government services to its constituents.

Cybersecurity and executive compensation: Can inside debt-induced risk aversion improve cyber risk management effectiveness?

This study contributes to the emerging literature on the determinants and the consequences of cyberattacks by examining the impact of inside debt compensation on a firm's likelihood of experiencing a cyberattack and on attacked firms' cash holdings, R&D investments, and asset tangibility. We provide compelling evidence that inside debt compensation reduces the probability of experiencing a cyberattack. Furthermore, we document that high inside debt CEOs reduce their firm's cash holdings while they increase R&D investments and asset tangibility once their firms experience a hacking incident. These effects persist for three years after the attack. Our results are robust to alternative measurements of inside debt compensation and after accounting for potential sample selection and endogeneity concerns. Our findings underscore the importance of inside debt compensation as a governance mechanism that alleviates inefficiencies related to cybersecurity investments.

More than malware: unmasking the hidden risk of cybersecurity regulations

Cybersecurity investments are made within a complex and ever-evolving environment, where regulatory changes represent a significant risk factor. While cybersecurity regulations aim to minimize cyber risks and enhance protection, the uncertainty arising from frequent changes or new regulations can significantly impact organizational response strategies. This paper explores the determinants and implications of regulatory risks associated with cybersecurity, aiming to provide a deeper understanding of how these risks influence strategic decision-making. The study delves into the suggestion of preventive and mitigative controls that enable businesses to adapt to and mitigate potential disruptions caused by regulatory changes, thereby preserving their established cybersecurity practices. Another key contribution of this study is the introduction of a stochastic econometric model that illustrates how regulatory risks and uncertainties can affect investment behaviors, often prompting a “wait-and-see” stance. This model synthesizes the complex relationship among investment choices, regulatory changes, and cybersecurity risks, providing insights into the dynamic nature of cybersecurity investment strategies. The research findings offer valuable guidance for risk management and strategic planning in cybersecurity investments. By comprehensively understanding the drivers and impacts of regulatory risks, businesses and policymakers can develop more effective risk evaluation and management approaches. This is essential for sustaining a strong cybersecurity posture while navigating the changing regulatory environment.

Cybersecurity carrots and sticks

AbstractIn an unsustainable trend, each year is touted as the worst on record for data and system breaches. 2020's dubious top distinction was exceeded across numerous metrics in 2021, and 2022's numbers set another unwanted record. The growing epidemic of ransomware, data breaches, and cyber‐enabled attacks pushes policymakers and business leaders to consider what can be done to reverse the cyber‐insecurity spiral. Amidst the current cybersecurity landscape fraught with regulatory gaps, dependence on self‐regulation, and resource constraints of small‐ and medium‐sized businesses, policymakers should seize opportunities to reward reasonable cybersecurity postures and disincentivize underinvestment in cybersecurity best practices. Bold and coordinated actions are needed to dislodge the unsustainable trend of increasingly damaging cyberattacks, and to create a more holistically secure digital future. To move the needle toward a more robust cybersecurity ecosystem, this article proposes an incentive‐based strategy that breaks the mandate‐versus‐self‐regulation dichotomy, leveraging a carrots and sticks tax approach to spur stronger cybersecurity postures across the ecosystem. Such proposal outlines a framework for a Federal Cybersecurity Investment Tax Credit, tailored and mapped to select entity types, combined with a cyberinsecurity tax, thus promoting the principle that businesses have basic cybersecurity responsibilities and fundamental duties to operate securely in a digital society. In addition, this article introduces supplementary tools as part of an enhanced cybersecurity tax policy toolkit. Given pressing national and global cyber risks, this article continues a long‐standing conversation about the operative use of tax policy as part of a holistic approach to reaching a secure and sustainable digital future.