We develop a model where a firm has an optimal exposure to cyber risk. With rational, fully informed agents and with no hysteresis, a successful cyberattack should have no impact on a financially unconstrained target's reputation and post-attack policies. In contrast, when a successful attack...

We examine which firms are targets of cyberattacks and how they are affected. We find that cyberattacks cause firms to reassess the risks that they are exposed to and their consequences, so that they have real effects on firm policies even when targets are not financially constrained....

Existing evidence shows convincingly that expected cash flows of non-financial firms can be negatively affected by their total risk, so that non-financial firms can create shareholder wealth by managing their total risk. After reviewing theories that demonstrate links between firm value and...