Digital Capital and Risk Exposure. The Cybersecurity Disclosure Paradox

Purpose: This study investigates whether firms’ disclosure of Digital Capital (DC) in sustainability reporting is associated with their exposure to cybersecurity risk, introducing the concept of the Cybersecurity Disclosure Paradox. Methodology: The study adopts a quantitative panel design based on 150 firm-year observations from 50 European listed companies over the period 2022–2024. Two original indices—the Digital Capital Disclosure Index (DCDI) and the Cyber Risk Exposure Index (CREI)—are manually constructed and analysed using firm and year fixed-effects regressions. Findings: Results show a significant negative relationship between cyber risk exposure and Digital Capital disclosure. Firms facing higher cybersecurity risk disclose less information on their digital human, structural and relational capital, suggesting that proprietary cost considerations and strategic secrecy prevail over legitimacy-driven transparency. Managerial implications: The findings highlight the need for managers to balance transparency and protection of strategic digital assets, supporting more effective digital governance and sustainability reporting under the evolving European regulatory framework. Research limitations: The exploratory nature of the study, the limited sample size and the focus on European listed firms limit the generalisability of the findings. Originality: The paper introduces and empirically validates the Cybersecurity Disclosure Paradox, extending the intellectual capital disclosure literature by integrating cybersecurity risk into the analysis of Digital Capital reporting.