The Economic Costs of Cyber Risk

Speaker: Dr Aniket Baksy

Affiliation: University of Melbourne

Location: Room 111, Chamberlain Building (#35), St Lucia Campus

Zoom: https://uqz.zoom.us/j/82603079317

Abstract: How does rising cyber risk affect the macroeconomy, and how should policymakers respond? We develop a general equilibrium model to quantify the economic costs of cyber risk. The model features strategic interactions between heterogeneous firms investing in cybersecurity and attackers targeting firms. Cyberattacks generate a negative externality by reducing aggregate productivity. We discipline the model using new firm-level evidence that the share of workers employed in cybersecurity occupations rises steeply with firm size. Because larger firms are more attractive targets but also invest more in protection, the model generates an inverse-U relationship between firm size and attack risk, consistent with the data. Introducing cyber risk reduces firm entry by 3.6 percent, aggregate productivity by 0.6 percent, and total output by 1.8 percent. These effects arise from general equilibrium adjustments in entry, firm size, and spillovers that are absent in typical partial-equilibrium analyses. Policy responses differ sharply: appropriately designed subsidies and minimum cybersecurity requirements can raise aggregate output, while bailouts reduce it.