The Impact of Ransomware Attacks on Security Portfolios: Firm-Level Panel Data

We study how firms adjust their cybersecurity postures after experiencing a cyber attack. We combine publicly disclosed ransomware cyber incidents with detailed data on security tool and vendor deployments from the SWZD Company Intelligence Database (CIDB) over multiple years. Our empirical approach compares attacked firms to similar non-attacked firms using a difference-in-difference (DID) framework. We find that there was little difference between attacked and non-attacked firms regarding the "breadth" of security posture before the attacks. Controlling for common changes made by all firms over time, in the "post attack" period, firms that were attacked increased the breadth of their security posture relative to non-attacked firms. They adopted more National Institute of Standards and Technology (NIST) functions and had broader category coverage than non-attacked firms in the "post attack" period. Attacked firms also dramatically increased the usage of security products from large and "platform" vendors relative to non-attacked firms in the "post attack" period. While we cannot determine whether the products from larger and platform vendors were of higher quality, that seems to be the ``revealed" beliefs of the attacked firms.