Cybersecurity risk ratings have recently drawn attention as a new player in the alt data arena. In this piece, we summarise the current academic status quo regarding cybersecurity breach incidents and financial market impact, before discussing the usability of relevant datasets from an event arbitrage and risk management perspective. 

Every year, the World Economic Forum publishes the Global Risks Report. In 2019, ‘massive data fraud and theft’ was ranked the number four global risk by likelihood over a 10-year horizon. ‘Cyber-attacks’ came in at number five.

The largest (reported) data leak of 2018 was suffered by the Indian government, when multiple breaches of its citizen ID database potentially comprised the records of 1.1 billion registered individuals.

Furthermore, in a way that is allegorical of the 20^th-century invention of nuclear weapons, the rise of machine learning and artificial intelligence has accelerated the cybersecurity arms race. The results are dystopian and disturbing. For instance, AI malware that can conceal WannaCry ransomware in a video-conferencing application and activates upon recognizing the face of the intended target.  Cybersecurity firm Dark Trace paints, in broad strokes, a picture of a future where ‘weaponized AI will adapt to the environment that it infects’ and learn to replicate trusted elements of internal systems in order to evade detection.

Another scenario puts a dark spin on the old adage ‘slow and steady wins the race’. Many security systems recognize potential threats by identifying anomalous data outflows (a.k.a. exfiltration), such that attackers will slow the extraction process to take place in chunks which are small enough to evade detection. When combined with AI, malware can optimize this process, allowing data to be unobtrusively exfiltrated in higher volumes during opportune moments – e.g. when an employee with an infected laptop is carrying out a video call.