Cybersecurity investment is just the beginning for firms protecting against data breaches

Cybersecurity threats and data breaches happen every day, affecting millions of people. In response, businesses are scrambling to protect themselves and their customers from hackers. But simply investing in cybersecurity technology and infrastructure is not enough, according to Harbert College of Business researchers.

In a paper forthcoming in the Journal of Management Information Systems,  Auburn Ph.D. candidate Niyanta Sookraj and Business Analytics and Information Systems Professor Yen-Yao Wang analyzed companies’ investments in cybersecurity and what impact it had on the firm’s financial risk. The duo reported two major findings: the benefit of the investment depends on its scale and integration as well as the diversity of the board. 

Wang said one motivation for the research was the contrasting reports he was seeing on firms’ investment in cybersecurity and the number of attacks happening. 

“Right now, you see companies spending a lot of money on cybersecurity,” said Wang, Bickerstaff associate professor. “Meanwhile, you also hear a lot of different reports in the news about data breach events around the world. Why, if companies are spending more money, are we seeing more data breaches happening?”

Sookraj, the lead author, wrote the paper as part of her dissertation, titled Essays on Organizational Risk in the Digital Economy. This paper addresses financial risk, and the other essays look at operational and strategic risk.

Sookraj said she initially expected to see a linear relationship between cybersecurity investment and financial risk—the greater the investment, the less risk. Instead, after reviewing previous studies that drew different conclusions, she and Wang discovered an inverted U-shaped curve instead.

“We’re seeing that as investment increases, initially firm risk will also increase, and we suspect that’s largely because the investments are not integrated into the firm yet,” said Sookraj, who earned her MBA from Auburn’s Harbert College of Business in 2022. “But after a certain threshold, as those investments become integrated into a broader, firm-wide strategy, risk will start to decrease.” 

Sookraj likened some firms’ investment into technology as akin to “greenwashing,” when a company makes misleading statements to make it appear more environmentally friendly than it actually is. Buying cybersecurity technology can signal to investors that a company is taking the threat seriously. But the real benefit happens in time as a company actually implements it and is able to significantly defend themselves against cyber threats. 

“In the early stages of the research, we found that CEOs and board members were saying they had these budgets for cybersecurity, but they weren't able to actually utilize them effectively and they weren't seeing the benefits come to fruition,” Sookraj said. “There isn't a linear benefit of investing in cybersecurity. It really matters what the scale of that investment is.”

Prior research has shown that when health companies implement new systems for patients’ records and employees are not familiar with the system, it initially leads to more data breaches, not less. The same idea applies to cybersecurity investments. 

Wang added that another area where firms might slip up is when they simply react to a data breach and invest in cybersecurity instead of planning it out more strategically and over the longer term. 

The other significant finding is that greater board diversity can flatten the U shape. Sookraj and Wang looked at age and tenure of board members, concluding that greater variation on a board leads to a lower rise in initial risk after an investment. This is likely due to the reduced groupthink in a diverse board.

But later on, as a company’s cybersecurity investment matures, board diversity can slow down the rate at which risk declines, largely due to coordination friction. 

“There is value in having experiential diversity on the board, but that value matters more depending on where you are in your own cybersecurity strategy,” Sookraj said. “If you're a firm that is just starting to invest in cybersecurity, having those diverse perspectives on the board can be really helpful. But on the other hand, if you're a resource-intensive firm, and you have been doing this for a while, having many diverse perspectives can slow consensus building to some extent.”

Sookraj and Wang conducted the study, “When more is better (or not): Cybersecurity investment, financial risk and board experience heterogeneity,” with Xin (Robert) Luo at Hong Kong Metropolitan University and Chenhui Guo at Penn State University.

###

 

Learn more about the doctoral program in information systems