Global Multinational Organizations: Unintended Threats from Nation-State Cyberwarfare

Global multinationals are as vulnerable as are nation-states to acts of state-sponsored cyberwarfare, no matter where they are headquartered or what their country of origin. In general, the unintentional or tangential collateral damage of nation-state motivated cyberwarfare impacts businesses of all kinds. We hypothesize that cyberwarfare has a particularly deleterious effect on global multinational corporations, not only in terms of the risk of loss and cost of prevention, but also in terms of the future viability of the multinational organizational structure. Are these global organizations at an increased risk because these entities are caught in the cross fire of nation-state cyberwarfare due to their multicountry location exposure? Global multinationals are so large that the combined sales of the world’s top 500 global corporations exceed one third of the GDP of every nation on earth (Fortune, 2021). A few examples of global multinationals include Lenovo, which has its headquarters in China with additional leadership offices in the US. Headquartered in Dallas, 7-Eleven stores operate 71,100 stores across 17 countries, including in Asia, Europe and North America. Pepsico, Coke, Kraft and Krispy Kreme are located worldwide, as are Audi, Ford, GM and more. Large steel producers (HBIS Group is found in China, Switzerland, South Africa, Australia, Serbia, and the US), energy companies (Royal Dutch Shell, Netherlands and UK), transportation providers (Maersk), software vendors (SAP) and consulting firms (the Big 4) are increasingly global in nature. Microsoft runs on 76% of the world’s personal computers, truly worldwide in scope. International companies are headquartered in countries that are large in size, from the US (Apple) or India (Infosys) to small in size, such as Finland (Nokia) or Luxembourg (ArcelorMittal). From a practitioner perspective, we argue that it is challenging for a Chief Information Security Officer (CISO) to build a robust cybersecurity infrastructure against cyberwarfare for the globally located organization. Further, the escalating risks of loss and costs of protection may increase internal corporate coordination costs and internal agency costs to the point of disincentivizing the global multinational organizational structure.