New Report Explores Relationship Between Cybersecurity Ratings and Stock Performance

We have just published a report, Cybersecurity Ratings and Stock Performance, which explores the relationship between a publicly traded company’s cybersecurity rating, as measured by SecurityScorecard, and the performance of its stock price over time. We covered the company after being briefed on its security rating system at RSA 2020.

At the time, we immediately wondered if there were a connection between a public company’s cybersecurity posture and its stock performance. Industry research does show a fairly clear relationship between a public company suffering a data breach and a decline in its share price, at least temporarily. Would that also mean that a company with a robust cybersecurity posture enjoys strong stock performance? That’s the question this report seeks to answer.

Until recently, looking into cybersecurity and stock performance would have been a hypothetical exercise. With SecurityScorecard, however, it is possible to determine the quality of cybersecurity practices for thousands of companies on a nearly instantaneous basis. Their technology scans a range of public information, including dark-web data, relating to a given company. From this, they are able to build a cyber risk profile that rates the security of the company’s networks, DNS, endpoint security, malware infections, patching, and so forth.

This report compares security ratings from SecurityScorecard with 52-week returns on shares for companies in the S&P 500 index, which comprises the shares of 500 large U.S. companies. The findings are surprising. Strong cybersecurity posture does not always translate into better stock price performance, with some exceptions. However, the data represents a snapshot of a time period, August 2019 to August 2020, when unprecedented events occurred.

Until recently, this would have been a hypothetical exercise. With SecurityScorecard, however, it is possible to determine the quality of cybersecurity practices for thousands of companies on a nearly instantaneous basis.

For example, technology companies that were able to adapt to the COVID-19 lockdown through continued remote operations showed decreasing cybersecurity scores due to the rapid implementation of remote workforces and an expanded attack surface. At the same time, revenue for this industry was increasing rapidly due to the global demand for remote business continuity technologies. In this context, a “low” cybersecurity rating could be a trailing indicator of positive stock movement when correlated with the latest business, industry, marketplace, and geopolitical intelligence.

Conversely, industries such as hospitality and tourism were affected significantly by the COVID-19 lockdowns. After all, the nature of these industries revolves around in-person services. As these businesses closed, computers were turned off, and the staff that used them could no longer be afforded.

Investment industry experts like Matthew Carr, Chief Trends Strategist of The Oxford Club, reacted positively to the report. As Carr shared, “Reading the SecurityScorecard research got my thoughts percolating. There are so many interesting findings that as an investor—not just in cybersecurity but a wide range of sectors covered by ProfitTrends—I couldn’t help thinking about all the ways I could use this data to improve returns or even incorporate it into in my selection process. In a world where cyberattacks are an increasing real threat to share price gains, I found this not only fascinating, but useful.”

“Reading the SecurityScorecard research got my thoughts percolating. There are so many interesting findings that as an investor—not just in cybersecurity but a wide range of sectors covered by ProfitTrends—I couldn’t help thinking about all the ways I could use this data to improve returns or even incorporate it into in my selection process. In a world where cyberattacks are an increasing real threat to share price gains, I found this not only fascinating, but useful.” – Matthew Carr, Chief Trends Strategist of The Oxford Club

According to Alex Heid, Chief Research & Development Officer at SecurityScorecard, “As markets recalibrate, enterprise cybersecurity postures adjust to newly deployed work from home environments, and the related incoming risk data plots itself out accordingly, a complete picture will begin to form over time. Surprising patterns will continue to take shape, and the data itself will narrate the next chapter of the story.”

Cybersecurity and stock performance trends are somewhat elusive, it seems. For those looking for a magic, heretofore secret indicator of future stock performance, this report will be disappointing. Rather, like any single source of information, a cybersecurity rating should not be interpreted at face value as an oracle for predictive stock price movement. There is no magic data feed that will tell an investor which stocks to “buy low” and “sell high.”

However, the report does reveal a new potential avenue of inquiry for stock market analysis and investigations of cybersecurity and stock performance. Although the stories behind the financial movements of any major enterprise are complex and multifaceted, cybersecurity ratings may prove useful as potential investment signals when correlated with updated business intelligence.

To download the report, visit the report page.

No registration is required.