US-Russia geopolitical risk and corporate cybersecurity risk: Evidence from 10-K reports

Abstract

Abstract As crimes, terrorism, and modern conflicts are no longer confined to the physical world, cyberspace is becoming a new frontier in warfare and political conflicts. In this paper, we investigate how Russia-related geopolitical risk drives corporate cybersecurity in US firms during 2006–2018. We show that the variations in US-related geopolitical risk alone explain more than 29% of the variation in US firms’ cybersecurity risk, suggesting that US-Russia geopolitical tensions stimulate cyber security risk in the US. The finding is robust to a battery of robustness and endogeneity tests. Further analyses show that the effect is quite persistent, stronger for US firms that have offshoring activities with Russian partners or assets, and weaker for firms with more innovative cultures. The effect also applies when the US imposes sanctions on Russia following the Crimea event in 2014.