A comparative analysis of information content in risk factors and management's discussion and analysis: evidence from the mandatory cybersecurity disclosures

Abstract

This study examines the information content of topic-specific cybersecurity disclosures following guidance from the U.S. Securities and Exchange Commission (SEC), 2011 , Securities and Exchange Commission (SEC), 2018 , Securities and Exchange Commission (SEC), 2023 , with a focus on how disclosure placement shapes informativeness. I develop a scalable topic-level Disclosure Completeness Index that captures the intensity and distribution of disclosures across eight regulator-identified cybersecurity categories. Using 13,800 firm-years from 2019 to 2024, I document substantial cross-topic heterogeneity and show that greater topic-level disclosure intensity is associated with weaker subsequent performance, consistent with disclosures reflecting underlying cybersecurity risk. Crucially, identical topics have systematically different associations depending on placement: Risk Factor disclosures are more strongly and consistently linked to next-year profitability and valuation than analogous narratives in the Management's Discussion and Analysis section. Topic-level analysis further indicates that disclosures related to operational exposure are the primary factors of these associations and are economically meaningful. In contrast, less frequently disclosed topics—such as the probability and magnitude of future incidents—exhibit limited predictive content. Additional analyses show that these patterns vary across industries with different levels of breach exposure. Overall, this study highlights disclosure placement as an economically meaningful dimension of textual reporting and introduces a reusable framework for evaluating the informational content of topic-specific disclosures.