Accuracy of Self Disclosed Cybersecurity Risks of Large U.S. Banks

Abstract

Publicly traded corporations are required by the Securities and Exchange Commission (SEC) to selfdisclose information security risks. However, because of several undefined factors, the risk information may not accurately reflect the threats within the Internet domain. Investors are then left ill-informed regarding this substantial risk to corporate value. This project quantifies the disparity between reported information security risks and information security threats.