Strategic Cybersecurity Management: The Impact of Knowledge Resources and Capabilities on Data Breach Risk

Introduction The unprecedented growth of cybercrime has led to a surge in data breaches, affecting hundreds of firms around the world. In 2023, 550 firms experienced data breaches (IBM 2024). The average cost of data breaches has been estimated to reach $4.45 million (IBM 2024), with indirect costs including decreased firm value, reputation, and competitive advantage (Foerderer and Schuetz 2022; Goel and Shawky 2009). This backdrop has encouraged researchers to explore the factors associated with data breach events and efficient cyber-defense strategies. Studies suggest that data breach events are occurred by both IS/IT and non-IS/IT environments of a firm. While significant preventive factors within the former include IT security investment, IT modernization, and vulnerable disclosure, CSR (corporate social responsibilities), mergers and acquisitions, and financial disclosure have been identified as significant antecedents within the latter (Schlackl et al. 2022). Given that these factors seem to be dynamic and deeply rooted in organizational practices, firms often face “strategic balance dilemma”. To justify, on one hand, firms’ security practices, such as employee security trainings, and security awareness, were shown to curb the risk of security breaches(Kweon et al. 2021; Li et al. 2023). On the other hand, their social practices, such as corporate social responsibility, may often lead to the increased risk of security breaches (D’Arcy et al. 2020). This highlights the criticality of strategic cybersecurity risk management. Given the growing cybersecurity talent gap and the increasing demand for cyber workforce, 93% of firms plan to outsource portions of their cybersecurity risk management to specialized service providers in the next two years (Newswire 2023). However, this strategy introduces new risks, as the rise of generative AI lowers the barrier for low-skilled adversaries to launch sophisticated attacks (CrowdStrike 2024). While outsourcing can offer benefits, it also poses security risks (Almutairi and Riddle 2018). Motivated by these developments, we consider two organizational strategic factors—(1) cybersecurity knowledge resources and (2) cybersecurity capabilities—in the context of data breach risk. We consider both external and external facets in the former, and proactive, protective as well as AI-based aspects in the latter. Cybersecurity knowledge resources are referred to, in this study, organizational cybersecurity personnel and their strategic management with respect to cybersecurity technologies. Likewise, cybersecurity capabilities are referred to a dynamic capability of the firm to strategically prevent cyber threats. Our conceptualization of these factors is motivated by two seminal works in organizational knowledge (Spender and Grant 1996) and