Digital Security Risk Disclosure and Investment Process

Growing interconnectedness and extensive access to cybersecurity systems increased related threats that could exploit organisations’ assets. To protect the assets, organisations can implement risk mitigation measures, or transfer risks to third parties. These organisations need to disclose the digital security implemented as part of the investor relations efforts. Because of this growing cybersecurity concern, this paper examines whether investors will invest in organisations that provide the digital security risk disclosure, since it is important to assess organisations’ ability to stay resilient and viable during this fast-paced technology advancement age. The researchers solicited two hundred and nineteen (219) responses from Malaysian organisations through questionnaires. Smart PLS was used to analyse the data. The results suggest that disclosure of digital security strategy, its risk mitigation, and its cyber events significantly impact the investment decision. Theoretically, this paper contributes to the literature on legitimacy theory, especially from the institutional pressure when organisations try to address the legitimacy gap during cybersecurity events. Digital security risk is growing in relevance to organisations and investors, but the current disclosure is insufficient, management should pay more attention to improving this area. Future studies may examine factors that impact digital security risks such as the role of financial implications, reputational concerns, and industry-specific regulations.