Short-Term Stock Market Reactions to Software Security Defects: An Event Study

As enterprises increasingly depend on software systems, security defects such as vulnerability disclosures, exploitations, and misconfigurations have become economically relevant risk events. However, their short-term impacts on capital markets remain insufficiently understood. This study examines how different types of software security defects affect short-horizon stock market behavior. Using a multi-model event-study framework that integrates the Constant Mean Return Model (CMRM), Autoregressive Integrated Moving Average (ARIMA), and the Capital Asset Pricing Model (CAPM), we estimate abnormal returns and trading-activity responses around security-related events. The results show that vulnerability disclosures are associated with negative abnormal returns and reduced trading activity, while exploitation events lead to larger price declines accompanied by significant increases in trading activity. Misconfiguration incidents exhibit weaker price effects but persistent turnover increases, suggesting that markets interpret them primarily as governance-related issues. Further analyses reveal that market reactions vary with technical severity, exposure scope, industry context, and firm role, and that cyber shocks propagate through both price adjustment and liquidity migration channels. Overall, the findings indicate that software security defects act as short-term information shocks in financial markets, with heterogeneous effects depending on event type. This study contributes to the literature on cybersecurity economics and provides insights for firms, investors, and policymakers in managing software-related risks.