US-Russia geopolitical risk and corporate cybersecurity risk: Evidence from 10-K reports

Abstract

As crimes, terrorism, and modern conflicts increasingly extend beyond the physical realm, cyberspace has emerged as a new frontier for warfare and political disputes. This paper investigates how Russia-United Stated geopolitical risks influence corporate cybersecurity in the United States (hereafter US) firms from 2006 to 2018. We employ various fixed effects models, the Instrumental Variables/Two-Stage Least Squares estimator, and an entropy balancing procedure for continuous treatment. Our empirical results indicate a strong and persistent relationship between US-Russia geopolitical risk and cybersecurity risk in the United States. This finding is robust to a comprehensive set of robustness and endogeneity tests. Further analysis reveals that the effect is more pronounced for US firms engaged in offshoring activities with Russian partners or assets, while it is weaker for firms with more innovative cultures. The effect is also observed following the US sanctions on Russia after the Crimea event in 2014. Our findings have significant implications for policymaking and business strategy. As international relations between the West and Russia deteriorate, the US government and its allies must invest more in cyberinfrastructure and cybersecurity at all levels. Supportive cybersecurity policies for US businesses across all sectors are crucial, as our empirical results demonstrate that all sectors are vulnerable to cyber breaches when geopolitical risk escalates.