Hacker attacks and data breaches have pushed cyber and data security to the top of company agendas everywhere. Investors must get to grips with the governance issues and growing business risks as a digitally powered world grapples with the need for more secure defenses.

Cyber and data security is a hot topic across sectors. Ever-evolving threats are forcing companies to continuously evaluate their defenses and readiness—to help minimize the damage of a potential attack. Public statements of preparedness often overstate the actual level of defenses in place.

Despite company awareness, cybersecurity isn’t a high priority for many investors. We think that’s a mistake—especially since governance issues are an important component of an environmental, social and governance (ESG) focus. Unprepared companies risk financial losses, penalties and reputational damage that can undermine a business, brand and compromise a stock or bond’s return potential. We spoke with cybersecurity professionals across multiple fields and reviewed the regulatory landscape to provide guidelines for investors on assessing cyber-risk management.

Counting the Costs of Escalating Attacks

Cyberattacks are very costly. In the first half of 2022, at least 2.8 billion malware attacks were recorded globally, an increase of 11% over the previous 12 months, according to cybersecurity company SonicWall.

The cost of a data breach reached a record $4.4 million per breach on average globally in 2022, based on a study by the Ponemon Institute and IBM Security. Recovery costs vary depending on the sophistication of a firm’s systems, and whether remote work was a factor, which tends to increase the expense.

Some industries are more at risk than others (Display). Yet in today’s online world, no company is safe. Increased risk has prompted increased regulation. In the US alone, three new regulations were released in the past year: the SEC cybersecurity rule, the Cyber Incident Reporting for Critical Infrastructure Act, and the Ransomware and Financial Stability Act of 2021. Meanwhile, governments are on high alert as state-sponsored cyberattacks surged at the onset of the Russia-Ukraine war. In this evolving environment, companies can’t afford to ignore the problem.

What Are the Biggest Challenges for Companies?

Many companies are addressing the risks by shifting on-premise data centers and security to cloud-based solutions. The pace is accelerating as issuers with smaller cloud storage capacity migrate to better synchronize their systems. But cloud-based security raises new concerns. We’ve heard several common themes from cybersecurity professionals.

Building the Infrastructure: Organizations face two key dilemmas—choosing from a large swathe of security providers and vendors, and managing them. Creating a single dashboard to manage a network of diverse solutions, ranging from end point protection to cloud systems parameter solutions, is a common problem, says one vendor who installs different cloud security platforms. And with so many similar options available, some organizations are paralyzed; they take too long to get the perfect fit rather than establishing an initial infrastructure to update over time.

Monitoring, Training and Governance of Systems: After completing the infrastructure, companies need properly trained staff to monitor and run the systems, as well as a governance structure to maintain its integrity. Streamlining various internal systems and security vendor products takes time and resources, a challenge further complicated because many major security providers are active acquirers of smaller companies, which can throw products out of sync.

What defines a strong cybersecurity governance structure? First, we think a clear reporting structure to the board committee responsible for oversight is essential, with jargon-free reports that can be easily understood by directors without cyber expertise. Similarly, a simple matrix classifying “High, Medium, Low” risks is helpful, as well as reports on mitigation action and threat taxonomies. The general counsel, board and business managers should interact with the information security team more frequently as governance matures. Oversight must extend to the employees running and monitoring systems. And companies should be aware that the vendors they choose matter; services that are more common will have more professionals available to run the systems.

Rising Costs of Implementation/Resourcing: Many CIOs told us they are struggling with costs. In some cases, engineers can make a single change on one server that dramatically increase overall costs for an entire system over time. What’s more, many vendors do not clearly outline the rising costs of monitoring and maintaining a robust cybersecurity infrastructure. Checks on employee additions and a forward-looking infrastructure cost model can help avoid these pitfalls, especially at companies with fewer dedicated cyber resources. Cyber insurance costs are another factor; insurance benefits may be reduced when new vendors are added and systems are updated, or if coverage decreases. For example, Lloyd’s of London recently announced it will stop selling insurance for state-backed cyber-attacks.

How Can Investors Evaluate Cyber Risk Management?

Investors must ask the right questions and focus on budgets to gauge a company’s cyber-strategy and actions. How are cyber issues reported to the board? How are risks monitored and escalated? What types of system tests and response plans are being deployed? Are employees prepared for an attack?

Discussions with directors and management can yield important evidence of cyber proficiency. In recent engagements, we found that companies with a strong sense of the risks are more willing to discuss the topic and provide details on governance, reporting and training. Vague or standard responses could indicate that a company is less prepared for threats, lags peers—and is more vulnerable to attack. Cyber budgets offer important insight into strategy and action. Transparency on spending for cyber insurance, resourcing, vendors, or in-house build helps complete the picture.

Coherent Strategies for Complex Threats

As threats increase, companies must step up efforts to combat attacks and secure their data and systems. Small- and medium-capitalization companies may face greater risks, as many are relatively early in their cybersecurity journeys and have gaps in their systems that could attract attacks.

For companies of all sizes, investors should scrutinize cyber systems in place and dig deeper into the governance, resourcing and reporting on security. With coherent strategies in each area, companies will be more prepared to prevent and respond to cyber-attacks. By engaging with management regularly on these issues, investors will be better equipped to incorporate a company’s cybersecurity profile into a broader risk assessment of portfolio candidates and holdings.

Robert Keehn, Proxy and ESG Engagement Associate from AB’s Responsible Investing team, contributed to this analysis.

The views expressed herein do not constitute research, investment advice or trade recommendations and do not necessarily represent the views of all AB portfolio-management teams and are subject to revision over time.

Learn more about AB’s approach to responsibility here

AllianceBernstein

AllianceBernstein

AllianceBernstein (AB) is a leading global investment management firm that offers high-quality research and diversified investment services to institutional investors, individuals, and private wealth clients in major world markets. We believe corporate responsibility, responsible investing and stewardship are intertwined. To be effective stewards of our clients’ assets, we strive to invest responsibly—assessing, engaging on and integrating material issues, including environmental, social and governance (ESG), and climate change considerations in most of our actively managed strategies. We also believe that strive to hold ourselves as a firm to similar practices that we ask of issues. Our stewardship practices, investment strategy and decision-making are guided by our purpose, mission and values.

Our purpose—pursue insight that unlocks opportunity—inspires our firm to act responsibly. While opportunity means something different to each of our stakeholders; it always means considering the unique goals of each stakeholder. AB’s mission is to help our clients define and achieve their investment goals, explicitly stating what we do to unlock opportunity for our clients. We became a signatory to the Principles for Responsible Investment (PRI) in 2011. This began our journey to formalize our commitment to identify responsible ways to unlock opportunities for our clients through integrating material ESG factors throughout most of our actively managed equity and fixed-income client accounts, funds and strategies. AB also engages issuers where it believes the engagement is in the best financial interest of its clients.

Because we are an active manager, our differentiated insights drive our ability to deliver alpha and design innovative investment solutions. ESG and climate issues are important elements in forming insights and in presenting potential risks and opportunities that can have an effect on the performance of the companies and issuers that we invest in and the portfolios that we build.

Our values provide a framework for the behaviors and actions that deliver on our purpose and mission. Values align our actions. Each value emerges from the firm’s collective character—yet is also aspirational.

• Invest in One Another means that we have a strong organizational culture where diversity is celebrated and mentorship is critical to our success. When we invest in one another, we empower our employees to reach their potential, so that they can help our clients realize theirs. This enables us to partner with clients to design and deliver improved investment outcomes.
• Strive for Distinctive Knowledge means that we collaboratively identify creative solutions to clients’ economic, ESG and climate- related investment challenges through our expertise in a wide range of investment disciplines, close collaboration among our investment experts and creative solutions.
• Speak with Courage and Conviction informs how we engage our AB colleagues and issuers. We seek to learn from other parts of our business to strengthen our own views. And we engage issuers for insight and action by sharing ideas and best practices.
• Act with Integrity—Always is the bedrock of our relationships and has specific meaning for our business. Unlike many other asset managers, we’re singularly focused on providing asset management and research to our clients. We don’t engage in activities that could be distracting, or create conflicts—such as investment banking, insurance writing, commercial banking or proprietary trading for our own account. We are unconflicted and fully accountable.

As of September 30, 2023, AB had $669B in assets under management, $458B of which were ESG-integrated. Additional information about AB may be found on our website, www.alliancebernstein.com.

More from AllianceBernstein