Cyber risks affect every company

Cyber-attacks and cyber warfare have increasingly made the headlines this year. When I wrote my book on geopolitics for investors in 2019, I included a chapter on cyber warfare as a major threat for this decade that investors weren’t paying enough attention to. I didn’t expect to be proven right quite that fast. 

A new paper by Hélène Rey from the London Business School and her colleagues does two interesting things. Using text analysis, they go through earnings calls of companies around the world to analyse the discussion of cyber risks. And they use the trends in these discussions to try to predict how likely it is that a company will be the target of a cyber-attack in the future. Their methodology shows a weak ability to be able to predict future cyber-attacks, so I would say it is a good start but nothing ready for prime time, yet.

However, what is interesting to see is how cyber risks have spread and grown over the last few years. First, from 2010 to 2015, cyber risks were mostly targeted at US companies and there mostly at companies with high levels of intellectual property like IT companies or companies with lots of customer data. But by 2020 companies in all major countries have become targets of cyber-attacks and cyber risks have become relevant everywhere. Even companies in India and Brazil are now popular targets of cybercriminals.

Intensity of cyber risk by country 2020

Source: Jamilov et al. (2021)

The other interesting observation is how frequent discussions of cyber risks have become on company earnings calls. In 2013, less than 2% of earnings calls discussed cyber risks. By the end of 2020, that had increased to almost 5%. And if that sounds low, then remember that companies usually only discuss cyber risks for one of two reasons on their earnings calls. Either, they have been attacked or they have made major investments in IT to protect against these attacks. And if one in twenty earnings calls discusses these topics today, it means that the costs of cyber attacks (either to prevent them or the losses from them) have become a major factor.

Share of earnings calls that discuss cyber risks (%)

Source: Jamilov et al. (2021)