A forthcoming paper in the Journal of Finance, one of the most prestigious peer-reviewed journals in financial economics, introduces a novel methodology for quantifying firm-level cyber risk exposure using computational linguistics applied to quarterly earnings call transcripts of publicly listed companies. The study, authored by Rustam Jamilov, Hélène Rey, and Ahmed Tahoun, is available in full here.

The researchers' dataset encompasses more than 14,000 firms across over 90 countries, spanning the period from 2003 to 2025 — a window that covers major episodes in the evolution of corporate cyber threats, from early large-scale data breaches through the rise of ransomware and state-sponsored intrusions. To validate their computational linguistics-based measure, the authors employed both human auditors and a large language model.

The paper presents several key findings regarding the financial impact of cyber risk exposure. According to the authors, cyber risk exposure demonstrably affects stock returns and corporate profits, is priced into the options market, serves as a predictor of actual cyberattacks, and propagates from the individual firm level to the broader sector level. Based on back-of-the-envelope calculations, the researchers estimate the global annual cost of cyber risk exposure at approximately $1 trillion — a figure larger than the annual GDP of many individual economies.

The authors state in their abstract: "This paper uses computational linguistics to introduce a novel measure of firm-level cyber risk exposure based on the quarterly earnings calls of listed firms. Our measure covers more than 14,000 firms from over 90 countries between 2003 and 2025."

Writing at Marginal Revolution, the blogger highlights the significance of the finding that markets price cyber risk, noting that this is a point that should not be readily forgotten. The post raises several interpretive questions: whether recent market declines could be attributed to heightened perceived cyber risk, whether the distribution of such declines is consistent with that hypothesis, and whether the data might even show the opposite of what the hypothesis would predict — namely, that companies with the strongest potential cyber defenses are suffering the largest losses. The post also poses the question of whether the estimated $1 trillion annual cost has increased in the current environment.

The original post was published at Marginal Revolution.