General Seminar - Aniket Baksy

The Economic Costs of Cyber Risk

How does rising cyber risk affect the macroeconomy, and how should policymakers respond? We develop a general equilibrium model to quantify the economic costs of cyber risk. The model features strategic interactions between heterogeneous firms investing in cybersecurity and attackers targeting firms. Cyberattacks generate a negative externality by reducing aggregate productivity. We discipline the model using firm-level evidence on cybersecurity investment, documenting that cybersecurity employment as a share of total employment rises steeply with firm size. Because larger firms are more attractive targets but also invest more in protection, the model generates an inverse-U relationship between firm size and attack risk. Introducing cyber risk reduces firm entry by 4 percent, aggregate productivity by 0.6 percent, and total output by 1.7 percent. These effects arise from general equilibrium adjustments in entry, firm size, and spillovers that are absent in partial-equilibrium analyses typical in the literature. Policy responses differ sharply: while subsidies to cybersecurity investment raise aggregate output, bailouts to attacked firms reduce it by weakening firms’ incentives to invest in protection.