Curated Measures

Cybersecurity Exposure

Data through Sep 30, 2026 Updated Oct 13, 2026 5 series

Measure corporate cybersecurity discussion in earnings calls, decomposed into executive disclosure and external analyst questioning.

We’ll email you when the data is updated. No account required.

At a glance

Coverage
About 16,700 companies in 94 countries
Period
Jan 2003 – Sep 30, 2026
Updates
Quarterly
Files

CSV: time series, firm panel

Source

English earnings calls

Overview

Built on Jamilov, Rey, and Tahoun (2025), this curated dataset counts sentences in earnings calls that match a validated 247-term cybersecurity dictionary. Alongside the full-call series, it provides four sub-series split by call section (Presentation vs. Questions and Answers) and speaker affiliation (Executives vs. External participants) to separate proactive management disclosure from analyst questioning.

Use it to

  • Separate voluntary executive disclosure in prepared remarks from analyst-driven questioning in Q&A.
  • Compare cybersecurity attention across industries, headquarters countries, and regulatory regimes.
  • Study industry spillovers in cyber discussion following major vulnerability disclosures or sector breaches.
  • Merge call-level cyber exposure counts with firm returns, IT spending, or incident records.

What it does not measure

  • Counts sentences matching the 247-term cybersecurity dictionary (Exposure), not sentences conditioned on the general Risk synonym dictionary.
  • Does not count realized cyberattacks, confirm breach occurrence, or score a firm's technical security posture.
  • For the section- and speaker-restricted series (Presentation, Q&A, Executives, External participants), normalize call-level counts using nr_of_sentences_filtered rather than full-call nr_of_sentences.

Explore the data

What to look for

In the US series, cybersecurity discussion hovered near 9.1–9.5 matched sentences per call from 2004 through 2010, climbed steadily after 2013 following major retail and financial data breaches, surged during the COVID-19 remote-work transition and the SolarWinds/Colonial Pipeline incidents to peak at 16.1 sentences per call in Q1 2021, eased to 13.7 in late 2023, and re-accelerated to 15.8 by Q3 2026 alongside AI-security and SEC cyber-disclosure rules.

Click the chart to open the series, where you can filter it by headquarters country.

CyberRisk: Global (All sections, all speakers) over time

Date range: January 1, 2003 to September 30, 2026.

Time-series chart for CyberRisk: Global (All sections, all speakers) over time.
Loading figure...

Mean matched sentences per earnings call, measured in Matched sentences, shown quarterly using a 4-quarter moving average. Q1 2003 to Q3 2026, 95 data points. Restricted to companies headquartered in United States. Higher values mean more topic discussion.

Explore series

Series

5 total Data through Sep 30, 2026

Browse the related series and open any series for its full query, filters, and methodology notes.

No series match your filter.

Methodology and data

Methodology

Based on The Anatomy of Cyber Risk (Jamilov, Rey, and Tahoun, 2025):

  • Cybersecurity dictionary (247 terms): Constructed from institutional cybersecurity glossaries (FSB, NCSC, CISA) and expanded via word-embedding keyword discovery on earnings calls, then deduplicated and human-audited to remove ambiguous terms.
  • Sentence-level matching: Each transcript is split into sentences. A sentence matches if it contains at least one term from the 247-term dictionary. The call-level Exposure measure equals the integer count of matched sentences in that call.
  • Channel decompositions: The same 247-term query is run separately across five scopes:
  • Global (All sections, all speakers) — full transcript.
  • Presentation — prepared remarks only.
  • Q&A — question-and-answer session only.
  • Executives — corporate participants only.
  • External participants — conference-call participants (such as equity analysts) only.

Full query terms are available on each underlying series page.

Changes to this dataset

Updated 13 October 2026. We recalculated this dataset's series with Updated search. They now run through 30 September 2026. Values for earlier quarters can differ slightly from the previous release, which is available on request.

References

Jamilov, R. & Rey, H. & Tahoun, A., "The Anatomy of Cyber Risk," Working paper (R&R at Journal of Finance) (2025)

NL Analytics. (2026). Cybersecurity Exposure [Data set]. NL Analytics. https://apps.nlanalytics.tech/curated-measures/cyber-risk/

Browse Curated Measures