|
|
|
| Cybersecurity Risk Governance and Firm Innovation: Identification and Discovery based on Large Language Models |
| YANG Peng, SUN Weizeng, TIAN Xuan, ZUO Xiangtai
|
School of Economics/Hefei Institute of Advanced Research, Anhui University of Finance and Economics;
Joint Research Institute, Nanjing Audit University;
PBC School of Finance, Tsinghua University;
School of Management, Xiamen University |
|
|
|
Abstract In the digital economy era, the deep penetration of data elements and rapid iteration of digital technologies have created unprecedented opportunities for corporate innovation, while simultaneously rendering cybersecurity risks a critical constraint on innovation. However, the academic literature has not reached a consensus on the impact of cybersecurity risks on firm innovation. From a risk-hedging perspective, Lattanzio and Ma (2023) argue that cybersecurity risks diminish the value of trade secrets and increase confidentiality costs, prompting firms to file more patents to protect intellectual property as a means of reducing reliance on trade secrets and hedging against data breach risks. Gomes et al. (2023) posit from a technological progress perspective that cybersecurity risks compel firms to prioritize internal cybersecurity defenses and increase research and development (R&D) expenditure in digital technologies. Conversely, He et al. (2020) find that firms experiencing cyberattacks tend to increase cash holdings as a precautionary measure against cybersecurity threats, resulting in reduced R&D investment. Wang et al. (2024) contend from an innovation cost perspective that cybersecurity risk prevention requires substantial capital investment to secure software, hardware, and network operations, thereby crowding out R&D funding.
Evidently, existing research provides insufficient guidance for corporate cybersecurity governance decisions. Regrettably, no studies have examined how cybersecurity risk governance affects firm innovation from a risk governance perspective. This paper argues that a primary source of the gap between theory and practice, and a key research challenge, lies in the inability of conventional text analysis methods to accurately capture corporate cybersecurity risk governance behavior. Listed firms typically disclose cybersecurity-related information in annual reports to signal their awareness of cybersecurity risks and corresponding governance measures to the market (Florackis et al., 2023). Consequently, scholars predominantly employ dictionary-based approaches, measuring cybersecurity risk exposure by the frequency of cybersecurity-related keywords in annual reports. However, keyword counts alone cannot determine whether firms have undertaken cybersecurity risk governance activities and may even lead to semantic misinterpretation. For instance, one listed firm's annual report states: “Although the overall security level of global cyberspace is improving, the global cybersecurity threat landscape remains severe, with data breaches, cyberattacks, critical vulnerabilities, and other cybersecurity incidents occurring frequently, seriously endangering internet users, corporate institutions, and even national security.” While this passage contains numerous cybersecurity-related terms such as “data breaches” and “cyberattacks,” semantic analysis reveals that the firm merely provides an objective description of global cybersecurity trends without addressing its own risk perception or governance actions.
To address this gap, this paper examines Chinese A-share listed companies from 2007 to 2021, employing large language models (LLMs) to construct a quantitative indicator of corporate cybersecurity risk governance and systematically investigate its impact on firm innovation. The findings reveal that cybersecurity risk governance significantly enhances innovation output, particularly promoting patent applications in cybersecurity technologies. Mechanism analysis demonstrates that cybersecurity risk governance influences innovation through three primary channels: First, improving data utilization efficiency, enabling firms to efficiently transform data assets into innovation outcomes while ensuring data security; Second, stabilizing collaborative innovation relationships by enhancing trust and cooperation with universities, research institutions, and business partners; Third, alleviating financing constraints by strengthening external investors' and creditors' confidence. Heterogeneity analysis indicates that this positive effect is more pronounced among firms operating in more complex digital environments, exhibiting higher technological dependence, and maintaining greater internationalization levels. Furthermore, from a supply chain perspective, this paper uncovers significant asymmetric spillover effects of corporate cybersecurity risk governance: upstream suppliers are incentivized to increase cybersecurity innovation investments, whereas downstream customers reduce their own innovation efforts by relying on core firms' security protections. This reveals the complex transmission mechanisms of cybersecurity governance in digital supply chains.
The main contributions of this paper are threefold. First, it proposes an LLM-based measurement method for corporate cybersecurity governance that effectively addresses semantic and expression ambiguity in Chinese texts, providing a novel technical approach for quantifying corporate risk governance behavior. Second, it elucidates the underlying mechanisms through which cybersecurity governance promotes firm innovation from a risk governance perspective, offering new evidence to resolve debates in the literature while providing clearer policy guidance. Third, it explores the vertical spillover effects of cybersecurity risks from a supply chain perspective, enriching the research framework on inter-firm network risk transmission and innovation interactions in the digital economy context.
Regarding policy implications, this paper argues that firms should regard cybersecurity governance as an integral component of innovation strategy rather than a mere cost burden. Governments should refine cybersecurity regulation and incentive mechanisms, encourage firms to strengthen cybersecurity risk governance, and construct collaborative security-innovation ecosystems. Future research may leverage cross-national data and incorporate institutional differences to further analyze the impact of cybersecurity risk governance on innovation.
|
|
Received: 22 July 2025
Published: 01 February 2026
|
|
|
|
|
| [1] |
耿勇、向晓建和万攀兵,2024,《供应链信任衰退:网络安全风险与企业贸易信贷》,《中国工业经济》第5期,第135～154页。
|
| [2] |
顾雷雷、郭建鸾和王鸿宇,2020,《企业社会责任、融资约束与企业金融化》,《金融研究》第2期,第109～127页。
|
| [3] |
江小涓、宫建霞和李秋甫,2024,《数据、数据关系与数字时代的创新范式》,《中国社会科学》第9期,第185～203+208页。
|
| [4] |
金星晔、左从江、方明月、李涛和聂辉华,2024,《企业数字化转型的测度难题:基于大语言模型的新方法与新发现》,《经济研究》第3期,第34～53页。
|
| [5] |
龙小宁、刘灵子和张靖,2023,《企业合作研发模式对创新质量的影响——基于中国专利数据的实证研究》,《中国工业经济》第10期,第174～192页。
|
| [6] |
陆瑶、施函青和周欣怡,2025,《中国企业数字技术风险暴露对企业价值的影响——来自大语言模型的文本分析证据》,《经济研究》第2期,第73～89页。
|
| [7] |
田子方、左从江、李涛、赵宣凯,2025,《诚信文化与金融企业社会责任承担》,《金融研究》, 第9期,第152～169页。
|
| [8] |
万晓莉、叶芸绮和方芳,2025,《从抵押物到现金流:间接融资如何支持创新型企业？》,《金融研究》第3期,第58～75页。
|
| [9] |
王辉、何冬昕、陈旭和姜富伟,2024,《网络安全治理与股价崩盘风险——基于上市公司年报文本分析的证据》,《金融评论》第1期,第86～106页。
|
| [10] |
夏太彪、魏志华、曾爱民和卢沛,2024,《社会保险缴费负担与企业转型升级》,《经济研究》第1期,第168～187页。
|
| [11] |
Calvo, N., S. Fernández-López, M. J. Rodríguez-Gulías, and D. Rodeiro-Pazos, 2022, “The Effect of Population Size and Technological Collaboration on Firms' Innovation,” Technological Forecasting and Social Change, 183, 121905.
|
| [12] |
Celeny, D., L. Maréchal, E. Rousselot, and M. Humbert, 2024, “Prioritizing Investments in Cybersecurity: Empirical Evidence from an Event Study on the Determinants of Cyberattack Costs,” arXiv preprint arXiv:2402,04773.
|
| [13] |
Chen, J. and J. Roth, 2024, “Logs with Zeros？ Some Problems and Solutions,” The Quarterly Journal of Economics, 139(2), 891～936.
|
| [14] |
Chesbrough, H. W., 2003, Open Innovation: The New Imperative for Creating and Profiting from Technology, Harvard Business Press.
|
| [15] |
Cohn, J. B., Z. Liu, and M. I. Wardlaw, 2022, “Count (and Count-like) Data in Finance,” Journal of Financial Economics, 146(2), 529～551.
|
| [16] |
Crosignani, M., M. Macchiavelli, and A. F. Silva, 2023, “Pirates without Borders: The Propagation of Cyberattacks through Firms' Supply Chains,” Journal of Financial Economics, 147(2), 432～448.
|
| [17] |
Demek, K. C. and S. E. Kaplan, 2023, “Cybersecurity Breaches and Investors' Interest in the Firm as an Investment,” International Journal of Accounting Information Systems, 49, 100616.
|
| [18] |
Florackis, C., C. Louca, R. Michaely, and M. Weber, 2023, “Cybersecurity Risk,” The Review of Financial Studies, 36(1), 351～407.
|
| [19] |
Garg, P., 2020, “Cybersecurity Breaches and Cash Holdings: Spillover Effect,” Financial Management, 49(2), 503～519.
|
| [20] |
Gomes, O., R. Mihet, and K. Rishabh, 2023, “Data Risk, Firm Growth, and Innovation,” Swiss Finance Institute Research Paper, No. 23-86.
|
| [21] |
Harris, D., C. Kuzey, C. Naaman, and N. Sahyoun, 2023, “Cybersecurity Risk Disclosure Quality: Does It Affect the Cost of Debt？,” Journal of Forensic and Investigative Accounting, 15(2), 192～212.
|
| [22] |
He, C. Z., T. Frost, and R. E. Pinsker, 2020, “The Impact of Reported Cybersecurity Breaches on Firm Innovation,” Journal of Information Systems, 34(2), 187～209.
|
| [23] |
Hirshleifer, D., P. H. Hsu, and D. Li, 2013, “Innovative Efficiency and Stock Returns,” Journal of Financial Economics, 107(3), 632～654.
|
| [24] |
Jamilov, R., H. Rey, and A. Tahoun, 2021, “The Anatomy of Cyber Risk,” NBER Working Paper.
|
| [25] |
Jiang, H., N. Khanna, Q. Yang, and J. Zhou, 2024, “The Cyber Risk Premium,” Management Science, 70(12), 8791～8817.
|
| [26] |
Kamiya, S., J. K. Kang, J. Kim, et al., 2021, “Risk Management, Firm Reputation, and the Impact of Successful Cyberattacks on Target Firms,” Journal of Financial Economics, 139(3), 719～749.
|
| [27] |
Lattanzio, G. and Y. Ma, 2023, “Cybersecurity Risk and Corporate Innovation,” Journal of Corporate Finance, 82, 102445.
|
| [28] |
Mizrak, F., 2023, “Integrating Cybersecurity Risk Management into Strategic Management: A Comprehensive Literature Review,” Research Journal of Business and Management, 10(3), 98～108.
|
| [29] |
Rassier, D. G., R. J. Kornfeld, and E. H. Strassner, 2019, “Treatment of Data in National Accounts.” BEA Advisory Committee. Burau of Economic Analysis.
|
| [30] |
Korinek, A., 2023, “Generative AI for Economic Research: Use Cases and Implications for Economists,” Journal of Economic Literature, 61(4), 1281~1317.
|
| [31] |
Sheneman, A., 2017, “Cybersecurity Risk and the Cost of Debt,” SSRN Working Paper.
|
| [32] |
Tian, X. and T. Y. Wang, 2014, “Tolerance for Failure and Corporate Innovation,” The Review of Financial Studies, 27(1), 211～255.
|
| [33] |
Tosun, O. K., 2021, “Cyber-attacks and stock market activity.” International Review of Financial Analysis, 76, 101795.
|
| [34] |
Wang, J., C. Y. C. Ho, and Y. G. Shan, 2024, “Does Cybersecurity Risk Stifle Corporate Innovation Activities？,” International Review of Financial Analysis, 91, 103028.
|
| [35] |
Wu, L., L. Hitt, and B. Lou, 2020, “Data Analytics, Innovation, and Firm Productivity,” Management Science, 66(5), 2017～2034.
|
|
|
|
