Personal traits of CEOs and cybersecurity-related disclosure

Abstract

Cybersecurity attacks represent a pressing corporate risk that has shaped contemporary practice worldwide. Motivated by the increased frequency of cyberattacks experienced by corporations around the world, we examine the effect of a CEO’s personal traits (i.e., qualifications, directorships, marital status, tenure, and age) on both the propensity and the level of cybersecurity-related disclosures. Using a sample of publicly traded U.S. firms during 2002–2020, we find the following results. Firms led by CEOs who have PhDs are likely to disclose less cybersecurity information, but firms led by CEOs who serve as directors of multiple firms show higher levels of disclosure. Furthermore, longer-tenured CEOs tend to disclose less, whereas married and older CEOs disclose more. Our findings suggest that the personal traits of managers are fundamental in explaining firms’ discrepant cybersecurity disclosure practices. The results offer new insights and have important implications for national regulators across the world, international accounting bodies, and investors. They also suggest directions for future studies of strategic responses to institutional pressures and firms’ cybersecurity policies and controls.