Cybersecurity risk and firm investment efficiency

• Cybersecurity risk does not significantly affect firm-level underinvestment. • Cybersecurity risk is positively associated with firm-level overinvestment. • Empire-building, external monitoring, and information asymmetry are key mechanisms. • Firms may exploit cybersecurity concerns to justify overinvestment. This paper examines the relationship between cybersecurity risk and firm investment efficiency. It documents that cybersecurity risk contributes to overinvestment but does not influence underinvestment. The results remain robust after considering endogeneity concerns and alternative model specifications. We also identify key underlying mechanisms driving the relationship, including empire-building, external monitoring, and information asymmetry. Specifically, the impact of cybersecurity risk on overinvestment is more pronounced among firms with greater empire-building tendencies, weaker external monitoring, and higher information asymmetry.