The Informativeness of Cybersecurity-Related Disclosures: Evidence from Australia and China

Cybersecurity risk has become an important corporate reporting and capital-market issue as regulators increasingly expect firms to disclose cyber-related risks, governance, and risk management. However, it remains unclear whether these disclosures are useful for investment decisions or primarily reflect compliance with formal reporting requirements. Prior research has rarely examined cybersecurity disclosure informativeness in annual reports across distinct domestic regulatory regimes. This study addresses this gap by comparing Australia and China and examining whether disclosure informativeness is associated with the cost of equity. The study uses 600 firm-year observations from 100 Australian and 100 Chinese firms covering FY2022–FY2024 and develops a codebook-based Cybersecurity-Related Disclosure Score capturing specificity, relevance, and usefulness. First, Australian firms provide significantly more informative cybersecurity disclosures than Chinese firms across the aggregate score, all three dimensions, and most individual indicators, with the largest differences in specific threat identification and business consequence disclosure. Second, the aggregate CSRDS score and the three dimension-level scores are not significantly associated with the cost of equity, including after industry adjustment. At the indicator level, business-consequence disclosure provides supplementary evidence of a negative association in the CAPM joint-indicator model and remains statistically significant after the primary Holm multiple-testing adjustment; however, this adjusted inference is not uniform across alternative indicator specifications or the LSEG financing-cost outcome. Third, formal interaction tests show that neither the aggregate CSRDS association nor the business consequence disclosure association differs significantly between Australia and China. These findings suggest that institutional context is more clearly reflected in disclosure production than in cross-country variation in capital-market consequences. They also highlight the importance of distinguishing specific disclosure content from aggregate disclosure indices when assessing cost-of-equity associations in cybersecurity reporting.