This paper uses computational linguistics to introduce a novel measure of firm-level cyber risk exposure based on the quarterly earnings calls of listed firms. Our measure covers more than 14,000 firms from over 90 countries between 2003 and 2025. The measure is validated using human auditors and a large language model. We show that cyber risk exposure affects stock returns and profits, is priced in the options market, predicts actual cyberattacks, and propagates from firm to sector level. Back-of-the-envelope estimates suggest that the global cost of cyber risk exposure is around $1 trillion per year.
That is from a recent paper by Rustam Jamilov, Hélène Rey, and Ahmed Tahoun, forthcoming in the Journal of Finance.
That the market prices cyber risk is a point we should not so readily forget. Is anyone arguing that recent market declines are due to higher perceived cyber risk? Does the distribution of these declines match that hypothesis? (Are we possibly seeing the opposite of what that hypothesis might predict, namely that those companies with the best potential defenses are suffering the most?) If the cyber risk cost per year had been about $1 trillion a year, what do we think it is now? Surely members of the rationality community will defer to the scientific methods of investigating these claims…
