Cybersecurity risk write-ups in filings predict profits, but where they appear matters

Same cybersecurity topics in different sections of required filings tracked next-year results differently.

Abstract editorial illustration accompanying the article: Cybersecurity risk write-ups in filings predict profits, but where they appear matters

Editorial illustration — not from the study.

Researchers analyzed topic-specific cybersecurity disclosures using U.S. SEC guidance, building an index to capture how intensively firms discussed eight cybersecurity categories and how those disclosures were distributed across them. They report large differences across topics and firms in how much information appears.

Across 2019 to 2024, higher disclosure intensity at the topic level was associated with weaker subsequent performance, consistent with disclosures reflecting underlying risk. But the strength of the links depended on placement: risk-factor disclosures tracked next-year profitability and valuation more strongly and consistently than comparable narratives in the Management’s Discussion and Analysis section, while rare details about the probability and scale of future incidents showed limited predictive value.

Where disclosures are placed

Using 13,800 firm-years from 2019 to 2024, the study found substantial cross-topic differences in required cybersecurity disclosures. Topics discussed more intensely were associated with weaker subsequent performance, which the authors interpret as consistent with disclosures reflecting underlying cybersecurity risk. The association depended on where the same topics were written: disclosures in the Risk Factors section showed stronger, more consistent links to next-year profitability and valuation than analogous narratives in the Management’s Discussion and Analysis section. The analysis suggests operational exposure-related disclosures drove much of these associations, while less frequently disclosed topics—such as the probability and magnitude of future incidents—had limited predictive content. These patterns also differed across industries with different levels of breach exposure.

Reporting structure changes signals

The results suggest that the usefulness of cybersecurity disclosures is not only about what companies say, but also about where they place it in their filings. By linking disclosure placement to next-year financial outcomes, the study provides evidence that textual reporting structure can shape how information relates to future performance.

Observational evidence, not proof

This is an observational, text-based analysis of mandatory cybersecurity disclosures in SEC-guided reporting, using statistical associations between disclosure measures and later firm outcomes over 2019–2024. The study’s framework was designed to evaluate informativeness, but the abstract does not establish causation—so it cannot show that disclosure placement causes changes in performance. The findings rely on the specific categories and disclosure guidance covered by the SEC materials and may not generalize beyond the studied filings. The abstract also does not describe how other factors (such as concurrent cybersecurity spending or broader business changes) were fully controlled, which could affect interpretation of the associations.

// Source

International Journal of Accounting Information Systems · 2026 · DOI: 10.1016/j.accinf.2026.100787

View paper (DOI)Open access versionPublished 2026-07-31

Authors: Ronald C. W. Tsang

Institutions: Mercer University

Reliable AI partnerships depend on people, not just stronger models

A survey of human-AI collaboration argues that more capable AI systems do not automatically produce reliable partnerships. It identifies human-centered design, governance and attention to high-stakes uses as central to making these systems trustworthy and beneficial.

9 hours ago·6 views

AI & Computing

RNA splicing tools can follow irrelevant clues and miss RNA’s shape

Deep-learning tools for predicting RNA splicing can rely on genomic clues unrelated to splicing and miss important effects of RNA structure, a study finds. These weaknesses were linked to systematic errors, especially when the tools evaluated sequences that differed from those used for training.

20 hours ago·5 views

AI & Computing

Better-trained AI finds more flaws in unfamiliar software projects

AI vulnerability detectors often perform less well on software projects outside their training data. A study finds that cleaner, more varied training data and an encoder-based design improved detection, including a reported 6.8% gain in recall on the BigVul benchmark.

2 days ago·34 views