优先投资网络安全：基于网络攻击成本决定因素的事件研究的实证证据
Prioritizing Investments in Cybersecurity: Empirical Evidence from an Event Study on the Determinants of Cyberattack Costs
AI总结：
本研究通过事件研究法分析2012-2022年上市公司网络事件，发现异常回报显著性在调整标准误后消失，数据泄露和医疗行业损失最大，为网络安全投资优先级提供实证依据。
摘要：
随着网络事件频率和严重性的不断增加，理解其经济影响至关重要。在此背景下，上市公司对网络事件的反应值得研究，因为（i）它们是估算其他组织所承担成本的良好代理，（ii）它们在经济中占据关键地位，并且（iii）其财务信息公开可用。我们从新闻通讯社头条中提取上市公司的网络事件日期和特征。我们使用2012年至2022年间的事件研究，采用事件前后三天的时间窗口和标准基准。我们发现，网络事件周围的异常回报幅度与先前使用新闻通讯社或替代数据识别网络事件的研究相当。相反，当我们调整标准误以考虑事件引起的方差和残差横截面相关性时，我们发现先前声称的异常回报显著性消失。鉴于这些结果，我们进行了规格的赛马比较，测试了网络事件类型、目标公司行业、时期及其交互作用的边际效应。数据泄露是最有害的事件类型，在过去十年中平均损失为-1.3%（或-19亿美元）。医疗行业对网络事件最为敏感，平均损失为-5.21%（或-12亿美元），当这些事件是数据泄露时更是如此。相反，我们无法显示网络事件的时间变化效应或先前所主张的新闻类型的特定效应。
英文摘要：
Along with the increasing frequency and severity of cyber incidents, understanding their economic implications is paramount. In this context, listed firms' reactions to cyber incidents are compelling to study since they (i) are a good proxy to estimate the costs borne by other organizations, (ii) have a critical position in the economy, and (iii) have their financial information publicly available. We extract listed firms' cyber incident dates and characteristics from newswire headlines. We use an event study over 2012--2022, using a three-day window around events and standard benchmarks. We find that the magnitude of abnormal returns around cyber incidents is on par with previous studies using newswire or alternative data to identify cyber incidents. Conversely, as we adjust the standard errors accounting for event-induced variance and residual cross-correlation, we find that the previously claimed significance of abnormal returns vanishes. Given these results, we run a horse race of specifications, in which we test for the marginal effects of type of cyber incidents, target firm sector, periods, and their interactions. Data breaches are the most detrimental incident type with an average loss of -1.3\% or (USD -1.9 billion) over the last decade. The health sector is the most sensitive to cyber incidents, with an average loss of -5.21\% (or USD -1.2 billion), and even more so when these are data breaches. Instead, we cannot show any time-varying effect of cyber incidents or a specific effect of the type of news as had previously been advocated.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
