Research: Digitalisation frontrunners are more vulnerable to cyberattacks

In his research, Sihvonen measured firms’ levels of digitalisation and examined whether being more digitally advanced than industry peers predicts future cyberattacks. The findings show that companies that are ahead of their competitors in digitalisation are up to 10 percentage points more likely to experience a successful cyberattack.

– Many executives see digitalisation as a way to strengthen cyber resilience, a view often reinforced by technology providers. However, our findings suggest that the relationship is not quite that straightforward. Digitalisation also introduces new vulnerabilities that organisations may find difficult to identify and manage, says Sihvonen.

The study analysed more than 9,600 observations from publicly listed US companies between 2006 and 2023. The dataset included 543 documented data breaches and other cyber incidents.

The problem lies not in technology itself, but in how it is organised

A key finding of the study is that the increased risk is not primarily driven by the technologies themselves. Instead, what matters is how digital technologies are implemented within organisations and integrated into business models and processes.

According to the findings, traditional monitoring and control mechanisms, such as external auditing, are not sufficient on their own to protect highly digitalised firms from cyber threats.

– The results suggest that cybersecurity management should increasingly be viewed as a strategic issue. The more digitalised a company becomes, the more important it is to ensure that cybersecurity expertise is represented in top management and on the board of directors, Sihvonen explains.

A need for a more realistic discussion of the benefits of digitalisation

The study challenges the assumption that digitalisation automatically strengthens companies’ cybersecurity. At the same time, it offers practical insights for business leaders at a time when organisations are investing heavily in artificial intelligence and new digital technologies.

Additional analyses also suggest that investors do not fully recognise the link between digitalisation and cyber risk. Stock markets often react to cyberattacks with a delay, but once the implications become apparent, the market response can be significant.

– Digitalisation and AI offer substantial opportunities for businesses, but they may also increase cyber exposure in ways that are not always fully understood. We need a more balanced discussion about both the benefits of digitalisation and the risks that accompany it, says Sihvonen.

Publication

Jukka Sihvonen (2026). Digitalization and Cybersecurity: Firm-level Evidence. British Journal of Management. https://doi.org/10.1111/1467-8551.70119