Cybersecurity Risk Governance and Firm Innovation: Identification and Discovery based on Large Language Models
YANG Peng, SUN Weizeng, TIAN Xuan, ZUO Xiangtai
School of Economics/Hefei Institute of Advanced Research, Anhui University of Finance and Economics; Joint Research Institute, Nanjing Audit University; PBC School of Finance, Tsinghua University; School of Management, Xiamen University
Summary:
In the digital economy era, the deep penetration of data elements and rapid iteration of digital technologies have created unprecedented opportunities for corporate innovation, while simultaneously rendering cybersecurity risks a critical constraint on innovation. However, the academic literature has not reached a consensus on the impact of cybersecurity risks on firm innovation. From a risk-hedging perspective, Lattanzio and Ma (2023) argue that cybersecurity risks diminish the value of trade secrets and increase confidentiality costs, prompting firms to file more patents to protect intellectual property as a means of reducing reliance on trade secrets and hedging against data breach risks. Gomes et al. (2023) posit from a technological progress perspective that cybersecurity risks compel firms to prioritize internal cybersecurity defenses and increase research and development (R&D) expenditure in digital technologies. Conversely, He et al. (2020) find that firms experiencing cyberattacks tend to increase cash holdings as a precautionary measure against cybersecurity threats, resulting in reduced R&D investment. Wang et al. (2024) contend from an innovation cost perspective that cybersecurity risk prevention requires substantial capital investment to secure software, hardware, and network operations, thereby crowding out R&D funding. Evidently, existing research provides insufficient guidance for corporate cybersecurity governance decisions. Regrettably, no studies have examined how cybersecurity risk governance affects firm innovation from a risk governance perspective. This paper argues that a primary source of the gap between theory and practice, and a key research challenge, lies in the inability of conventional text analysis methods to accurately capture corporate cybersecurity risk governance behavior. Listed firms typically disclose cybersecurity-related information in annual reports to signal their awareness of cybersecurity risks and corresponding governance measures to the market (Florackis et al., 2023). Consequently, scholars predominantly employ dictionary-based approaches, measuring cybersecurity risk exposure by the frequency of cybersecurity-related keywords in annual reports. However, keyword counts alone cannot determine whether firms have undertaken cybersecurity risk governance activities and may even lead to semantic misinterpretation. For instance, one listed firm's annual report states: “Although the overall security level of global cyberspace is improving, the global cybersecurity threat landscape remains severe, with data breaches, cyberattacks, critical vulnerabilities, and other cybersecurity incidents occurring frequently, seriously endangering internet users, corporate institutions, and even national security.” While this passage contains numerous cybersecurity-related terms such as “data breaches” and “cyberattacks,” semantic analysis reveals that the firm merely provides an objective description of global cybersecurity trends without addressing its own risk perception or governance actions. To address this gap, this paper examines Chinese A-share listed companies from 2007 to 2021, employing large language models (LLMs) to construct a quantitative indicator of corporate cybersecurity risk governance and systematically investigate its impact on firm innovation. The findings reveal that cybersecurity risk governance significantly enhances innovation output, particularly promoting patent applications in cybersecurity technologies. Mechanism analysis demonstrates that cybersecurity risk governance influences innovation through three primary channels: First, improving data utilization efficiency, enabling firms to efficiently transform data assets into innovation outcomes while ensuring data security; Second, stabilizing collaborative innovation relationships by enhancing trust and cooperation with universities, research institutions, and business partners; Third, alleviating financing constraints by strengthening external investors' and creditors' confidence. Heterogeneity analysis indicates that this positive effect is more pronounced among firms operating in more complex digital environments, exhibiting higher technological dependence, and maintaining greater internationalization levels. Furthermore, from a supply chain perspective, this paper uncovers significant asymmetric spillover effects of corporate cybersecurity risk governance: upstream suppliers are incentivized to increase cybersecurity innovation investments, whereas downstream customers reduce their own innovation efforts by relying on core firms' security protections. This reveals the complex transmission mechanisms of cybersecurity governance in digital supply chains. The main contributions of this paper are threefold. First, it proposes an LLM-based measurement method for corporate cybersecurity governance that effectively addresses semantic and expression ambiguity in Chinese texts, providing a novel technical approach for quantifying corporate risk governance behavior. Second, it elucidates the underlying mechanisms through which cybersecurity governance promotes firm innovation from a risk governance perspective, offering new evidence to resolve debates in the literature while providing clearer policy guidance. Third, it explores the vertical spillover effects of cybersecurity risks from a supply chain perspective, enriching the research framework on inter-firm network risk transmission and innovation interactions in the digital economy context. Regarding policy implications, this paper argues that firms should regard cybersecurity governance as an integral component of innovation strategy rather than a mere cost burden. Governments should refine cybersecurity regulation and incentive mechanisms, encourage firms to strengthen cybersecurity risk governance, and construct collaborative security-innovation ecosystems. Future research may leverage cross-national data and incorporate institutional differences to further analyze the impact of cybersecurity risk governance on innovation.
杨鹏, 孙伟增, 田轩, 左祥太. 网络安全风险治理与企业创新——基于大语言模型的识别与发现[J]. 金融研究, 2026, 547(1): 76-94.
YANG Peng, SUN Weizeng, TIAN Xuan, ZUO Xiangtai. Cybersecurity Risk Governance and Firm Innovation: Identification and Discovery based on Large Language Models. Journal of Financial Research, 2026, 547(1): 76-94.
Calvo, N., S. Fernández-López, M. J. Rodríguez-Gulías, and D. Rodeiro-Pazos, 2022, “The Effect of Population Size and Technological Collaboration on Firms' Innovation,” Technological Forecasting and Social Change, 183, 121905.
[12]
Celeny, D., L. Maréchal, E. Rousselot, and M. Humbert, 2024, “Prioritizing Investments in Cybersecurity: Empirical Evidence from an Event Study on the Determinants of Cyberattack Costs,” arXiv preprint arXiv:2402,04773.
[13]
Chen, J. and J. Roth, 2024, “Logs with Zeros？ Some Problems and Solutions,” The Quarterly Journal of Economics, 139(2), 891～936.
[14]
Chesbrough, H. W., 2003, Open Innovation: The New Imperative for Creating and Profiting from Technology, Harvard Business Press.
[15]
Cohn, J. B., Z. Liu, and M. I. Wardlaw, 2022, “Count (and Count-like) Data in Finance,” Journal of Financial Economics, 146(2), 529～551.
[16]
Crosignani, M., M. Macchiavelli, and A. F. Silva, 2023, “Pirates without Borders: The Propagation of Cyberattacks through Firms' Supply Chains,” Journal of Financial Economics, 147(2), 432～448.
[17]
Demek, K. C. and S. E. Kaplan, 2023, “Cybersecurity Breaches and Investors' Interest in the Firm as an Investment,” International Journal of Accounting Information Systems, 49, 100616.
[18]
Florackis, C., C. Louca, R. Michaely, and M. Weber, 2023, “Cybersecurity Risk,” The Review of Financial Studies, 36(1), 351～407.
Gomes, O., R. Mihet, and K. Rishabh, 2023, “Data Risk, Firm Growth, and Innovation,” Swiss Finance Institute Research Paper, No. 23-86.
[21]
Harris, D., C. Kuzey, C. Naaman, and N. Sahyoun, 2023, “Cybersecurity Risk Disclosure Quality: Does It Affect the Cost of Debt？,” Journal of Forensic and Investigative Accounting, 15(2), 192～212.
[22]
He, C. Z., T. Frost, and R. E. Pinsker, 2020, “The Impact of Reported Cybersecurity Breaches on Firm Innovation,” Journal of Information Systems, 34(2), 187～209.
[23]
Hirshleifer, D., P. H. Hsu, and D. Li, 2013, “Innovative Efficiency and Stock Returns,” Journal of Financial Economics, 107(3), 632～654.
[24]
Jamilov, R., H. Rey, and A. Tahoun, 2021, “The Anatomy of Cyber Risk,” NBER Working Paper.
[25]
Jiang, H., N. Khanna, Q. Yang, and J. Zhou, 2024, “The Cyber Risk Premium,” Management Science, 70(12), 8791～8817.
[26]
Kamiya, S., J. K. Kang, J. Kim, et al., 2021, “Risk Management, Firm Reputation, and the Impact of Successful Cyberattacks on Target Firms,” Journal of Financial Economics, 139(3), 719～749.
[27]
Lattanzio, G. and Y. Ma, 2023, “Cybersecurity Risk and Corporate Innovation,” Journal of Corporate Finance, 82, 102445.
[28]
Mizrak, F., 2023, “Integrating Cybersecurity Risk Management into Strategic Management: A Comprehensive Literature Review,” Research Journal of Business and Management, 10(3), 98～108.
[29]
Rassier, D. G., R. J. Kornfeld, and E. H. Strassner, 2019, “Treatment of Data in National Accounts.” BEA Advisory Committee. Burau of Economic Analysis.
[30]
Korinek, A., 2023, “Generative AI for Economic Research: Use Cases and Implications for Economists,” Journal of Economic Literature, 61(4), 1281~1317.
[31]
Sheneman, A., 2017, “Cybersecurity Risk and the Cost of Debt,” SSRN Working Paper.
[32]
Tian, X. and T. Y. Wang, 2014, “Tolerance for Failure and Corporate Innovation,” The Review of Financial Studies, 27(1), 211～255.
[33]
Tosun, O. K., 2021, “Cyber-attacks and stock market activity.” International Review of Financial Analysis, 76, 101795.
[34]
Wang, J., C. Y. C. Ho, and Y. G. Shan, 2024, “Does Cybersecurity Risk Stifle Corporate Innovation Activities？,” International Review of Financial Analysis, 91, 103028.
[35]
Wu, L., L. Hitt, and B. Lou, 2020, “Data Analytics, Innovation, and Firm Productivity,” Management Science, 66(5), 2017～2034.
