Cyberattack, cyber risk mitigation capabilities, and firm productivity in Kenya
利用2016年肯尼亚企业ICT调查数据，研究发现网络安全漏洞会降低企业劳动生产率，而员工技能提升能有效缓解这种负面影响，尤其对中小企业效果显著。
Abstract Most scholarly work has focused on the positive effects of digitalisation in Sub-Saharan Africa without accounting for the associated risks and mitigation measures at the firm level. Using the 2016 Enterprise ICT Survey of Kenya which provides a rich source of information on the use of ICT among firms, we examine the effect of cybersecurity breach on labour productivity and show how this effect is moderated by cyber risk mitigation capabilities at the firm level. We find that cybersecurity breach reduces labour productivity at the firm level. We also find that upskilling mitigates the negative effect of cybersecurity breach on labour productivity especially for Small and Medium-sized Enterprises. The results further suggest that while Information Technology Policy and Information Technology Security capabilities can enable firms to improve labour productivity, these measures are not sufficient to offset the adverse effect of cybersecurity breach on labour productivity. Together the results imply that upskilling is an effective cyber risk mitigation measure against cybersecurity breaches at the firm level and therefore should be an integral part of the overarching IT governance strategy of firms.