Business Strategy and Cybersecurity Breaches

Abstract

This study examines whether a firm’s business strategy is an underlying determinant of cybersecurity breach likelihood. Based on organizational theory, firm strategy can focus on innovation or efficiency, with innovative strategy firms being more likely to have weaker, decentralized control systems, multiple technologies, and greater risk than firms with an efficiency-focused strategy. Following the Miles and Snow (1978) strategy topology, we predict and find that the prospector business strategy is associated with greater breach likelihood. We further explore IT awareness within the firm. Ex ante, it is unclear whether strategic IT policy formation is impounded into a firm’s strategy or can be impacted by individual executives and nonstrategy firm characteristics. We find that IT understanding at the executive or firm level can affect the relationship between strategy and breach likelihood. Collectively, our results indicate that business strategy is a useful indicator in evaluating firms’ cybersecurity activities.