Best Practices for Public Companies to Communicate Cybersecurity Investments to Investors on Q3 2024 Calls

Cyber threats are escalating both in frequency and sophistication and public companies continue to face increasing pressure to bolster their cybersecurity defenses. These incremental investments are critical to safeguarding assets and to maintain investor confidence and enhancing valuation. Effective communication with investors about these investments is essential, especially when addressing both tangible and intangible risks in the short term.

As we move into Q3 2024, here are some best practices for public companies to communicate cybersecurity initiatives to investors for valuation impact.

1. Align Cybersecurity Investments with Business Strategy

Investors need to see how cybersecurity investments support the company’s overall business objectives. Clearly articulate how these initiatives protect critical assets, ensure operational continuity, and enable the company to pursue growth opportunities without undue risk.

? Action Point: During earnings calls or investor meetings, explain how cybersecurity spending aligns with strategic goals, such as entering new markets, launching digital products, or enhancing customer trust.

2. Quantify the Impact on Financial Performance

While cybersecurity is often seen as a cost center, it’s important to demonstrate its value in financial terms. Leverage valuation focus to show how mitigating cyber risks can protect and potentially enhance cash flows, reduce the cost of capital, and preserve company valuation.

? Action Point: Provide estimates of potential financial losses avoided through cybersecurity investments, such as preventing data breaches that could lead to regulatory fines, legal costs, and reputational damage.

3. Emphasize Short-Term Actions with Long-Term Benefits

Investors are interested in how short-term investments can lead to sustainable long-term value. Highlight the immediate steps the company is taking to harden cybersecurity defenses and how these actions position the company for future resilience.

? Action Point: Outline specific short-term initiatives, such as implementing advanced threat detection systems or conducting employee training programs, and explain how these efforts contribute to long-term stability and growth.

4. Enhance Transparency and Disclosure?

Transparency builds trust. Provide clear and comprehensive information about the nature of cyber risks faced by the company and the measures taken to address them. This includes discussing both tangible risks (like financial losses) and intangible risks (such as reputational harm).

? Action Point: Include detailed disclosures in annual reports and regulatory filings about cybersecurity governance, risk management frameworks, and incident response plans.

5. Address Risk Management and Compliance

Investors are laser focused on understanding how the company manages risk and complies with relevant regulations. Communicate the company’s commitment to meeting or exceeding industry standards and regulatory requirements related to cybersecurity.

? Action Point: Discuss adherence to frameworks like NIST Cybersecurity Framework or ISO/IEC 27001, and explain how compliance efforts reduce risk exposure.

6. Leverage Valuation Insights

Apply valuation insights to illustrate the positive impact of cybersecurity investments on the company’s risk profile and expected returns. By reducing the probability of costly cyber incidents, the company can improve its risk-adjusted valuation metrics.

? Action Point: Use scenarios and models to show how effective cybersecurity measures can lower the company’s beta (a measure of risk) and enhance shareholder value.

7. Communicate Proactively and Consistently

Regular communication about cybersecurity efforts keeps investors informed and reassured. Proactive updates prevent speculation and demonstrate that the company is vigilant about emerging threats.

? Action Point: Establish a consistent schedule for reporting on cybersecurity initiatives, whether through quarterly reports, dedicated cybersecurity briefings, or updates during investor calls.

8. Involve Leadership in Communication

Having top executives, including the CEO and CFO, discuss cybersecurity emphasizes its importance to the company. Leadership involvement signals that cybersecurity is a strategic priority.

? Action Point: Ensure that senior executives address cybersecurity topics in their communications, highlighting commitment from the highest levels of the organization.

9. Highlight Competitive Advantage

Effective cybersecurity can be a differentiator in the market. Emphasize how robust cybersecurity measures enhance customer trust, protect intellectual property, and provide a competitive edge.

? Action Point: Share examples of how cybersecurity initiatives have enabled the company to win contracts, enter new markets, or retain key clients.

10. Encourage Investor Engagement

Invite questions and feedback from investors regarding cybersecurity. This engagement can provide valuable insights into investor concerns and help tailor future communications.

? Action Point: During investor meetings or calls, allocate time for discussing cybersecurity and addressing investor inquiries.

By thoughtfully communicating incremental cybersecurity investments, public companies can effectively mitigate both tangible and intangible risks while reinforcing investor confidence. These best practices not only safeguard assets but also enhance the company’s valuation by aligning risk management with financial performance and strategic objectives.

?

?