Digitalization and Cybersecurity: Firm‐level Evidence

Abstract

Digitalization has opposing effects on cybersecurity: While new digital technologies can strengthen security capabilities, they simultaneously expand potential attack surfaces. To determine which effect dominates, we analyse 9606 US firm‐years (2006–2023) with 543 documented breaches and find that increased digitalization, measured through 10‐K business descriptions, significantly raises the likelihood of future cyber breaches. A one‐standard‐deviation increase in digitalization corresponds to up to a 10 percentage point higher breach probability, driven primarily by organizational rather than technological dimensions. Expert auditors and cybersecurity disclosure reduce breach likelihood, but their protective effect attenuates as digitalization rises; that of board and C‐suite technology expertise instead strengthens. These findings qualify the protective role of conventional monitoring in highly digitalized firms and point to a repositioning of cybersecurity governance from external monitoring towards digital expertise embedded in strategic decision‐making.