REPORT

Cybersecurity investment has historically been viewed as a necessary evil that creates a drag on profitability in exchange for managing operational risk. In response to continual data breaches, geopolitical instability, and the evolving nature of threats in the modern era, governments and international regulators are prioritizing cybersecurity for enhanced regulation. A traditional model of financial investment and returns fails to capture dynamic trends toward improved governance in cyberspace.

Stakeholder capitalism and environmental, social, and corporate governance (ESG) provide a new lens for calculating cybersecurity investment. Proactively focusing on social and governance standards creates a competitive advantage, specifically in operational risk management, due to a full accounting of stakeholders in an increasingly aggressive regulatory environment.

To illustrate the value of proactive cyber risk management, we dissect over 400 public cybersecurity failure events over 7 years that resulted in a range of financial losses. We highlight instructive case studies and further illuminate patterns in loss types — namely, that a breach does incur an extended period of financial loss (even if relatively minor), but the loss is only a microcosm of the larger harm that companies experience. Finally, we discuss the future of good cyber governance and best practices in proactive risk management as the regulatory landscape continues to accelerate and evolve.

Read this new report to learn:

• Why traditional financial models fail to capture the ROI of cyber risk mitigation investments
• How viewing security investments through ESG and regulatory lenses alters the return on investment
• What good cyber governance and proactive risk management looks like in an evolving threat and regulatory landscape