Cyberattack, cyber risk mitigation capabilities, and firm productivity in Kenya

Abstract Most scholarly work has focused on the positive effects of digitalisation in Sub-Saharan Africa without accounting for the associated risks and mitigation measures at the firm level. Using the 2016 Enterprise ICT Survey of Kenya which provides a rich source of information on the use of ICT among firms, we examine the effect of cybersecurity breach on labour productivity and show how this effect is moderated by cyber risk mitigation capabilities at the firm level. We find that cybersecurity breach reduces labour productivity at the firm level. We also find that upskilling mitigates the negative effect of cybersecurity breach on labour productivity especially for Small and Medium-sized Enterprises. The results further suggest that while Information Technology Policy and Information Technology Security capabilities can enable firms to improve labour productivity, these measures are not sufficient to offset the adverse effect of cybersecurity breach on labour productivity. Together the results imply that upskilling is an effective cyber risk mitigation measure against cybersecurity breaches at the firm level and therefore should be an integral part of the overarching IT governance strategy of firms.