Discussion paper

DP18668 Cyber Risk-Driven Innovation in the Modern Data Economy

We construct a heterogeneous-firm growth model of the data economy, where data, crucial for business optimization, is at risk of being damaged and destroyed by cyber criminals. Digitally-savvy firms invest in in-house cybersecurity, which can be used to improve the quality of their other products, and trade cybersecurity protection with non-digitally-savvy firms. We use the model to study the impact of cybercrime risk on firm innovation and aggregate growth. Theoretically, we find that cyber-crime unequivocally leads to reduced knowledge stocks, decreased productivity, and slower overall economic growth for all firms. Cybercrime risk mitigates some of the adverse effects as it ex-ante prompts digitally-savvy firms to pursue digital innovation that enhances productivity in other domains. We then test the theoretical prediction using several unique data sets on firms’ in- vestments in cyber-protection. Empirically, we observe increased innovation rates in response to higher cyber-crime risk, driven primarily by data-intensive firms and by firms which intensively pursue in-house cybersecurity protection rather than third-party cybersecurity delegation.


da Costa Gomes, O, R Mihet and K Rishabh (2023), ‘DP18668 Cyber Risk-Driven Innovation in the Modern Data Economy‘, CEPR Discussion Paper No. 18668. CEPR Press, Paris & London. https://cepr.org/publications/dp18668