Disentangling the sources of cyber risk premia

TL;DR

This paper introduces a machine learning-based method to quantify firms' cyber risks from disclosures, revealing that high cyber risk scores are associated with stock outperformance and that markets treat cyber risks as a single aggregate factor.

Contribution

It presents a novel machine learning approach to measure cyber risks from textual disclosures and demonstrates their significance in asset pricing and market perception.

Findings

High cyber scores correlate with stock outperformance.

Long-short cyber risk factors exhibit positive risk premia.

Markets perceive cyber risks as an aggregate, not differentiated types.

Abstract

We use a methodology based on a machine learning algorithm to quantify firms' cyber risks based on their disclosures and a dedicated cyber corpus. The model can identify paragraphs related to determined cyber-threat types and accordingly attribute several related cyber scores to the firm. The cyber scores are unrelated to other firms' characteristics. Stocks with high cyber scores significantly outperform other stocks. The long-short cyber risk factors have positive risk premia, are robust to all factors' benchmarks, and help price returns. Furthermore, we suggest the market does not distinguish between different types of cyber risks but instead views them as a single, aggregate cyber risk.