Securing the Digital Edge: How Security Management Mediates the Impact of ICT Infrastructure on Firm Performance in Emerging Markets

Background Information and communication technology (ICT) infrastructure drives firm performance in emerging markets, yet institutional voids and security vulnerabilities often undermine its efficacy. The mechanisms linking ICT endowment, organizational security investment, and firm-level outcomes remain underexplored, particularly in developing economies. Methods We tested a recursive three-block structural equation model (SEM) on nationally representative microdata from Peru’s Annual Economic Survey 2024 (N = 9,966 firms across 14 sectors). The model integrated the Resource-Based View (RBV) and Routine Activity Theory (RAT) to specify pathways from ICT infrastructure, internet access, and digital human capital through security management investment to firm performance (large vs. medium/small firms, by INEI survey format). Parameters were estimated by maximum likelihood; robustness checks re-estimated the model without small firms and with continuous log sales as the outcome. Mediation analysis decomposed total effects via bootstrap confidence intervals (5,000 replications). Results ICT infrastructure was the dominant predictor across all equations (β = 0.356 in security management; β = 0.327 in firm performance, both p < 0.001). Security management significantly mediated 17.6% of ICT’s total effect on performance (indirect β = 0.070, p < 0.001). Criminal victimization exposure directly predicted security investment (β = 0.060, p < 0.001), establishing a protective response mechanism predicted by Routine Activity Theory. The main paths hold without small firms and with continuous log sales as the outcome. Model fit indices confirmed excellent fit (CFI = 0.988, RMSEA = 0.029, GFI = 0.987). Conclusions In volatile emerging market environments, security management functions as a strategic resource that transforms raw ICT connectivity into sustainable competitive advantage — a phenomenon we term “Digital Resilience.” These findings challenge technological determinism and provide a blueprint for firms and policymakers in developing economies to integrate security as a core dynamic capability rather than a cost center.