Essays about cybersecurity risk management

The evolution of digitalization offers substantial benefits but also exposes firms to severe vulnerabilities, making cybersecurity risk management critical for preserving shareholder value. This dissertation examines the financial and strategic implications of cybersecurity risk management across three interconnected dimensions: corporate disclosures, supply chain networks, and organizational diversification. Theoretically grounded and empirically examined, the dissertation evaluates how different risk management strategies and structural configurations affect firms’ exposure to cybersecurity risk and the adverse economic consequences of breaches. The first study examines how ex-ante cybersecurity disclosures can affect post-breach financial impacts. It empirically shows that cybersecurity disclosures are strategic and have lasting effects on shareholder judgment. Driven by shareholders’ loss aversion, emphasizing preventive strategies reduces negative post-breach market reactions, whereas highlighting mitigative strategies intensifies market penalties. This study demonstrates that ex-ante cybersecurity disclosures shape economic outcomes and function as strategic levers beyond mere transparency. The second study focuses on cybersecurity risk spillover effects in the supply chain network. It investigates shareholder reactions to client firms when suppliers experience breaches and identifies shared technology vendors as intermediaries connecting breached suppliers and clients. Grounded in structural network risk theory and supported by an event study of more than 3,000 supplier breaches, this research concludes that shareholders appear to view these intermediaries as conduits of contagion through which cybersecurity risk propagates across the network. The findings also show that client firms’ ex-ante cybersecurity disclosures serve as governance signals that mitigate cybersecurity risk spillovers. The third study focuses on how organizational diversification relates to cybersecurity risk. Based on the Loose Coupling Theory, it finds that higher global diversification (greater overseas expansion), by establishing a loosely connected structure, plays a protective role, reducing cybersecurity risk and post-breach financial penalties. In contrast, higher industrial diversification (more business units) increases internal interconnectedness, raises cybersecurity vulnerability, and amplifies negative market reactions following a breach. Collectively, these three studies offer a unified explanation of how different observable organizational cues could shape shareholder judgments and how firms could manage their cybersecurity environment through cybersecurity disclosures, supply chain structure, and diversification structures to obtain cybersecurity resilience.