Thread by @MalwareJake

This is drawing a lot of ire from the infosec crowd because there's no obvious causality. We SHOULD be careful not to assign causality where there is none. But this data IS valuable and we shouldn't dismiss it because it lacks a causal link. 1/n
comparitech.com/blog/informati…

The study authors note that the biggest problem with this sort of study is the sample size is small. There simply are not that many publicly traded companies that have suffered significant breaches available to study. There are also many factors, making causality difficult. 2/n

Some interesting takeaways: Stock price goes down immediately after a breach, but recovers quickly after. This doesn't surprise me at all. @RenditionSec works a lot of breach cases and this tracks with our experience in privately held companies. 3/n

Most of our customers who suffer a breach lose some business short term. But we've noted a sort of Streisand Effect with breaches that are publicly disclosed. The organization that has the breach gets a bunch of free media coverage (albeit negative) and that hurts short term. 4/n

But a few months later, the company has better name recognition due to the media coverage and few can remember why they've heard of the breached org. They do business with org because of name recognition. Behavioral economists call this "familiarity bias" 5/n

The familiarity bias continues to have an impact, but orgs must innovate to stay ahead of their competitors. A breach distracts them from that innovation and largely puts them in survival mode, where the breach takes focus away from long term innovation and business thrusts. 6/n

This leads to long term (2-5 year) underperformance against their competitors. The study cited in this thread seems to confirm this, noting that the 3 year performance is below the NASDAQ average. Note that at 3+ years, there are many other factors that may impact share price 7/n

This is a tough problem to study. I applaud the authors for putting it together. I will suggest that most infosec pros calling this FUD read a story about the report, not the report itself. We need more data in the industry and this is a GREAT example of it. 8/n

Of course this study isn't perfect, none ever will be. But this shows that there is a positive correlation between breaches and market performance. Do what you will with this data, but let's celebrate that we have the data in the first place. 9/9