Paper Number
ICIS2026-2123
Paper Type
Short
Abstract
Generative AI (GenAI) may create security vulnerabilities while supporting organizational defense. We examine whether firms more exposed to GenAI-relevant tasks experienced different breach outcomes after ChatGPT's release. Combining a pre-release task-based exposure index with a monthly panel of 5,695 U.S. Compustat firms, we estimate DID, DDD, and event-study models. Higher-exposure firms experienced fewer breaches after December 2022. Subsequent 10-K disclosures and a supplementary disclosure-timing design show that the exposure measure predicts public GenAI engagement. Mechanism evidence comes from 23,929 firm-year 10-K filings and two preregistered experiments. Higher exposure was associated with larger post-release increases in threat- and countermeasure-related disclosure. In experiment 1 (N = 267), optional GenAI access improved countermeasure knowledge and phishing detection. In experiment 2 (N = 358), task-time access produced the larger coefficients; direct comparisons between the two access conditions were statistically imprecise. The archival analysis evaluates task-based opportunity, while the experiments manipulate assistant access.
Recommended Citation
Wang, Le; Huang, Xukai; Luo, Xin (Robert); Lowry, Paul Benjamin; and Yang, Chaofan, "Breakthrough or Breakdown? Firm-Level Generative AI Exposure and Data Breach Risk" (2026). ICIS 2026 Proceedings. 6.
https://aisel.aisnet.org/icis2026/security/security/6
Breakthrough or Breakdown? Firm-Level Generative AI Exposure and Data Breach Risk
Generative AI (GenAI) may create security vulnerabilities while supporting organizational defense. We examine whether firms more exposed to GenAI-relevant tasks experienced different breach outcomes after ChatGPT's release. Combining a pre-release task-based exposure index with a monthly panel of 5,695 U.S. Compustat firms, we estimate DID, DDD, and event-study models. Higher-exposure firms experienced fewer breaches after December 2022. Subsequent 10-K disclosures and a supplementary disclosure-timing design show that the exposure measure predicts public GenAI engagement. Mechanism evidence comes from 23,929 firm-year 10-K filings and two preregistered experiments. Higher exposure was associated with larger post-release increases in threat- and countermeasure-related disclosure. In experiment 1 (N = 267), optional GenAI access improved countermeasure knowledge and phishing detection. In experiment 2 (N = 358), task-time access produced the larger coefficients; direct comparisons between the two access conditions were statistically imprecise. The archival analysis evaluates task-based opportunity, while the experiments manipulate assistant access.
When commenting on articles, please be friendly, welcoming, respectful and abide by the AIS eLibrary Discussion Thread Code of Conduct posted here.
Comments
08_Cybersecurity_and_privacy