Abstract

This dissertation examines the role of financial analysts in evaluating cybersecurity events within the commercial banking industry. The focus on commercial banks arises from their visibility and attractiveness as cyber attack targets. The increasing number of such incidents in recent years has garnered significant public scrutiny, especially from investors and analysts. The situation engenders a sense of ambiguity regarding the outlook of the affected business.
The dissertation comprises two complementary empirical chapters. Chapter 2 presents an exploratory case study on financial analysts’ interactions with management in the context of conference calls following cyber incidents. Such interaction provides insights into the kind of information that financial analysts seek from management, and which presumably enters analysts’ decision-making process when forecasting a bank’s financial situation. The case study reveals that financial analysts ask more questions about cyber-related issues such as digital fraud, cloud technology, and technological investments to encourage top management at some banks to discuss their prevention efforts concerning cybersecurity risks and controls. When asked directly, managers discuss cyber incidents upfront.
Chapter 3 examines how cybersecurity incidents at commercial banks affect analyst forecast properties. Cyber incidents affect financial analysts’ information environment on two dimensions: uncertainty and information asymmetry. After security breaches, information asymmetry increases due to management’s standard practice of securing cybersecurity data to mitigate potential negative financial consequences. Despite the high information asymmetry underlying their earnings forecasts, analysts seek to improve the information environment's quality and reduce uncertainty in the financial market.
Financial analysts who change their earnings forecasts in reaction to cyber attacks do not necessarily do better than those who did not revise their forecasts. Prior studies show that low information asymmetry reduces forecasting risks and drives financial analysts to revise earnings forecasts regularly. Since cyber information is scarce, financial analysts are reluctant to change their earnings estimates when information asymmetry is high. In addition, analysts exhibit different forecasting behaviors depending upon the type of cyber event (involving confidentiality, integrity or availability issues).
This thesis provides new insight into the information dynamics around cybersecurity by concentrating on a significant market intermediary. The thesis contributes to the literature on financial analysts by highlighting their demand for information related to cybersecurity issues and reactions to cybersecurity events. Thus, this thesis advances our understanding of the inputs analysts use in decision-making and how they respond to events that exacerbate uncertainty and information asymmetry in the information environment. Regulators could use these findings to orient their policies regarding mandatory disclosure requirements or guidance on cybersecurity issues. Managers can learn about what cybersecurity-related disclosures capital markets require.