By Christos Makridis, PhD, Senior Researcher, Gallup; Research Associate Professor, W. P. Carey School of Business Arizona State University; Digital Fellow, Stanford University, Digital Economy Lab; Chair, CGCI National Security Research Alliance (NSRA)
For most organizations, cybersecurity spending is still treated as a form of insurance. The logic is defensive. Avoid breaches. Satisfy regulators. Reduce the probability of a bad outcome. That framing is increasingly inadequate in an economy where digital systems are now the backbone of intangible capital, organizational coordination, and customer trust. Especially with the ubiquity of social and formal media, a salient attack can fundamentally damage a company’s reputation.
In a generative AI world, the stakes rise further. According to our research at Gallup and our Workforce Panel, 26% of employees are using genAI daily or multiple times a week at work. As firms integrate AI into workflows, customer interfaces, and decision systems, they expand both their digital surface area and the value at risk.Every new piece of software and hardware can add capabilities, but they also create new vulnerabilities that need to be managed.
Two strands of evidence point in the same direction. First, cybersecurity failures already carry material economic consequences that extend far beyond immediate remediation costs. Second, investments in cybersecurity increasingly behave like general purpose investments whose value compounds through complementary organizational gains.
Cyber risk already prices into the real economy
In recent work with coauthors, I examine how local cyberattacks propagate into financial markets and public capacity. Using municipal bond data, we show that major cyber incidents raise borrowing costs and constrain access to capital for affected communities – that is, more data breaches within a county make investors less likely to finance new debt, holding all else equal, thereby raising bond yields. Higher yields translate into delayed infrastructure, reduced public services, and thinner fiscal buffers. Cyber risk, in other words, is not contained within the IT department. It reshapes investment conditions in the real economy.
A parallel pattern appears in private markets. In separate work with Tim Liu, we introduce a direct measure of firm level cybersecurity exposure based on network vulnerabilities through a collaboration with Rapid7, rather than relying on disclosures in publicly reported financial statements. Firms with greater exposure underperform persistently in equity markets. The mechanism is not just headline breaches. It is the steady erosion of intangible capital through operational disruption, remediation spending, and lost trust that accumulates over time.
Together, these findings challenge a narrow compliance view of cybersecurity. Markets are already treating cyber risk as a determinant of capital costs, firm value, and public capacity. The problem is that organizational investment frameworks have not caught up.
The generative AI multiplier
This gap becomes more consequential as generative AI diffuses. AI adoption raises productivity, but it also deepens dependence on complex digital systems, data pipelines, and external integrations. Each of these layers introduces new vulnerabilities and new spillover risks. A breach in an AI enabled environment does not merely interrupt operations. It compromises models, data integrity, and decision processes that sit at the core of value creation.
The evidence from the Gallup Workforce Panel also shows that cybersecurity is no longer an enterprise only concern. Retail consumers increasingly report using AI powered tools for finance, health, education, and creative work. As households integrate these tools into daily life – often sharing sensitive information in chat histories and potentially failing to adhere to account security best practices – expectations about digital trust, privacy, and resilience become part of the social infrastructure of markets. Failures in cybersecurity now reverberate not just through firms and governments, but through consumer confidence in the digital economy itself.
This is the context in which cybersecurity shifts from a defensive line item to a strategic investment in system reliability.
Why traditional ROI misses the point
The core measurement problem is that cybersecurity investments rarely look attractive in short run accounting terms. They often raise costs without an immediate revenue offset. They reduce tail risk rather than boosting quarterly performance. In budgeting frameworks optimized for near term margins, this makes them appear discretionary.
But this logic misunderstands the nature of the asset being built. Cybersecurity increasingly functions like a general purpose investment, similar to early investments in electrification, enterprise IT, or logistics platforms. The returns are realized not through a single channel but through a web of complementarities in the medium to long run. That may help explain why my work with Tim Liu finds a high degree of persistence in companies’ network vulnerabilities.
Stronger cybersecurity improves data governance, which improves analytics. It strengthens system reliability, which raises the returns to automation and AI. It enhances customer trust, which supports digital distribution. It disciplines internal processes, which improves coordination across teams. These spillovers do not show up in the cybersecurity budget line. They show up in organizational capability over time.
Toward a new investment logic
If cybersecurity is a general purpose investment, it needs to be evaluated accordingly. That means shifting from a prevention frame to a capability frame.
- Measurement must move beyond breach avoidance. Organizations should track how cybersecurity investments affect system uptime, data quality, speed of digital adoption, and resilience under stress. These are leading indicators of long run value, not just risk reduction. Together with Erik Brynjolfsson, we lay out a similar strategy for AI.
- Capital allocation needs longer horizons. Organizations such as the Council on Global Competition and Innovation – CGCI are beginning to translate this logic into investment frameworks that treat cyber resilience as a precondition for long-run value creation. Boards often approve multi year investments in physical infrastructure or brand building despite weak short run payoffs. Cybersecurity deserves the same treatment because it underwrites the returns to every other digital investment – whether through positive spillovers or avoiding large damages.
- Policy should recognize cybersecurity as part of economic infrastructure. Just as transportation and energy systems enable growth, digital resilience increasingly conditions the productivity of labor, capital, and innovation. Public and private incentives should reflect that reality.
From insurance to infrastructure
The transition to an AI intensive economy makes one point unavoidable. Cybersecurity is no longer a background function designed to keep bad things from happening. It is a foundational input into how modern organizations create value.
The old logic treated cybersecurity as a cost center. The emerging logic treats it as infrastructure for intangible capital. Markets are already behaving as if this is true. It is time for investment frameworks to do the same.
