Paper Number
ICIS2026-2123
Paper Type
Short
Abstract
Generative AI (GenAI) may create security vulnerabilities while supporting organizational defense. We examine whether firms more exposed to GenAI-relevant tasks experienced different breach outcomes after ChatGPT's release. Combining a pre-release task-based exposure index with a monthly panel of 5,695 U.S. Compustat firms, we estimate DID, DDD, and event-study models. Higher-exposure firms experienced fewer breaches after December 2022. Subsequent 10-K disclosures and a supplementary disclosure-timing design show that the exposure measure predicts public GenAI engagement. Mechanism evidence comes from 23,929 firm-year 10-K filings and two preregistered experiments. Higher exposure was associated with larger post-release increases in threat- and countermeasure-related disclosure. In experiment 1 (N = 267), optional GenAI access improved countermeasure knowledge and phishing detection. In experiment 2 (N = 358), task-time access produced the larger coefficients; direct comparisons between the two access conditions were statistically imprecise. The archival analysis evaluates task-based opportunity, while the experiments manipulate assistant access.
Recommended Citation
Wang, Le; Huang, Xukai; Luo, Xin (Robert); Lowry, Paul Benjamin; and Yang, Chaofan, "Breakthrough or Breakdown? Firm-Level Generative AI Exposure and Data Breach Risk" (2026). ICIS 2026 Proceedings. 6.
https://aisel.aisnet.org/icis2026/security/security/6
Breakthrough or Breakdown? Firm-Level Generative AI Exposure and Data Breach Risk
Generative AI (GenAI) may create security vulnerabilities while supporting organizational defense. We examine whether firms more exposed to GenAI-relevant tasks experienced different breach outcomes after ChatGPT's release. Combining a pre-release task-based exposure index with a monthly panel of 5,695 U.S. Compustat firms, we estimate DID, DDD, and event-study models. Higher-exposure firms experienced fewer breaches after December 2022. Subsequent 10-K disclosures and a supplementary disclosure-timing design show that the exposure measure predicts public GenAI engagement. Mechanism evidence comes from 23,929 firm-year 10-K filings and two preregistered experiments. Higher exposure was associated with larger post-release increases in threat- and countermeasure-related disclosure. In experiment 1 (N = 267), optional GenAI access improved countermeasure knowledge and phishing detection. In experiment 2 (N = 358), task-time access produced the larger coefficients; direct comparisons between the two access conditions were statistically imprecise. The archival analysis evaluates task-based opportunity, while the experiments manipulate assistant access.
Comments
08_Cybersecurity_and_privacy