Can you have your cake and eat it too? A tale of cybersecurity and operational efficiency

Abstract

Information security has become the chief concern among corporate executives in the digital age, while the operational efficiency has been the primary concern of the corporate executives for a long history. This study would like to investigate the tale of cybersecurity and firms' operational efficiency – when the companies experience the data breaches, the firms' operational efficiency may be impacted and managers would be reminded of the significance of cybersecurity and pay more attention to the related issues. The attention based-view (ABV) of firms suggests that the managers have limited attention and they will allocate their attention according to the salience of different problems. Thus managers may put more additional resources, such as financial resources and employees, into the recovery issues from the damage of the data breaches. With the distraction of managers' attention and other operational resources to the cybersecurity and recovery issues, operational efficiency would decrease. Using a unique longitudinal data set of US listed firms from 2006 to 2016 and employing the PSM-DiD method, this paper shows that firms would experience a significant operational efficiency decrease after data breaches. The results are robust to a variety of tests on variable definitions, selection and endogeneity issues. Further dynamic DiD tests show that this deterioration effect only lasts for one year after data breaches. Besides, under the three premises of the ABV, focus of attention, structural distribution of attention, and situated attention, this paper finds that the negative relation between data breaches and operational efficiency would be ameliorated under different conditions in individual, organizational, and social levels respectively. Specifically, this paper finds that managerial risk-taking incentives, financial slack, and highly product competitive market would weaken the attention-distraction channel and the negative breach-efficiency relation. Taken together, the findings reveal the negative effect of data breaches on operational efficiency and firms' trade-off between cybersecurity and operational efficiency with limited managers' attention.