How to Analyze Investments’ Hacking Vulnerability

MGM stock is down nearly 13% since the beginning of a cyberattack that destabilized operations at the casino giant last month. This poses a big question for asset owners: How do you determine what stocks are safe to invest in from a cybersecurity standpoint? The MGM hack, and other incidents in recent years, have shown there are consequences not only for a company, but for its shareholders.

But how can institutional investors insulate themselves from cyber risks when making investment decisions? What industries are most susceptible to cyber-attacks? These questions were central to a presentation at CIO’s Cybersecurity livestream event, by Doug Clare, head of cyber strategy at ISS Corporate Solutions, which, like CIO, is owned by Institutional Shareholder Services Inc.

ISS ESG Cyber Risk Score

ISS has developed a rating, the ISS ESG Cyber Risk Score, that evaluates a company’s susceptibility to cyberattacks. The metric aims to quantify what industries and companies within the Russell 3000 Index are exposed to digital threats.

For more stories like this, sign up for the CIO Alert newsletter. 

The score is designed to measure the odds of a digital attack affecting the company within the next 12 months. The rating leverages data gathered on a continuous basis regarding network and domain posture, construction and evidence of compromise. The score is a scaled representation of the odds of a breach incident ranging from high risk (300) to less risk (850).

At Risk Industries

According to Clare’s presentation on sector relative cyber risk, 33% of companies experienced a breach or disruption within the last 12 months. However, some industries are more at risk than others.

According to ISS research, the most at-risk industries in the Russell 3000 are technology, media and telecom. The least at-risk sectors are health care; energy and utilities; and finance and banking, all significantly lower than the average risk of all industries.

What It Means for Investors

The ISS ESG Cyber Risk Score can play a role in vetting investments, especially for institutional investors concerned about digital risks. It is one tool institutions can use in the due diligence process.

“There is a documented impact on share price when breach events occur, the score does translate directly into breach incident odds, and I think it has a meaningful role to play in evaluating risk,” Clare said. “If cyber breach risk is something you are concerned about, this is a metric you could and should look at.”

As seen with MGM, cyberattacks can have double-digit impacts on the price of a company’s shares and add millions in cost to its spending. In the modern age, this is something institutional investors should monitor and evaluate. The ISS ESG Cyber Risk Score offers investors a tool to develop a better understanding of a company’s potential exposure to such attacks.

How To Vet a Provider’s Cybersecurity Processes
How Private Equity Firms Can Protect ‘Treasure Trove’ From Digital Threats
Cybersecurity Breaches at UK Pensions Soar More Than 4,000% in 1 Year

Tags: CIO, Cybersecurity, Doug Clare, Institutional Shareholder Services, ISS ESG Cyber Risk Score

The California Public Employees’ Retirement System continued to have the largest under-allocation to private equity among 352 pension funds worldwide in the third quarter of 2023, while the New York State Common Retirement Fund had the largest over-allocation, according to S&P Global Market Intelligence data.

The median target private equity allocation was $265.5 million, while the median actual allocation was $270.5 million, indicating that the pension funds had a $5 million net over-allocation to private equity in Q3, as of September 22, compared with a $6.4 million net under-allocation to private equity in Q2.

CalPERS was $6.83 billion short of its $60.03 billion target, as its under-allocation grew from $6.81 billion the previous quarter but was still well below the $11.34 billion under-allocation recorded during Q1. The $454 billion pension giant was followed by Swedish pension fund AP7, which had the next-biggest under-allocation, falling $4.62 billion short of its $7.69 billion target. Although CalPERS had the larger under-allocation, it only represented slightly more than 11% of its target, while AP7’s under-allocation represented approximately 60% of its target.

The $254.1 billion New York State Common Retirement Fund had the largest over-allocation among the pension funds during the third quarter at $11.69 billion, up from $11.56 billion the previous quarter. The NYSCRF was followed by the $307.9 billion California State Teachers’ Retirement System’s $8.07 billion over-allocation, a 71% increase from the $4.73 billion over-allocation the previous quarter.

Want the latest institutional investment industry news and insights? Sign up for CIO newsletters. 

CalPERS and CalSTRS had the largest private equity allocation at $53.19 billion and $49.83 billion, respectively, while the Burlington (Vermont) Employees’ Retirement System, the Maynard (Massachusetts) Contributory Retirement System and the City of Franklin (Tennessee) Employees’ Pension Plan and Trust had the lowest allocations at $1 million each.

S&P noted that private equity fundraising declined 20.5% worldwide to $444.65 billion during the first half of the year from $559.02 billion in the same period one year ago, which it attributed to a short cash supply among limited partners. S&P also cited Bain & Co.’s mid-year report, which said that buyout funds have a record $2.8 trillion in un-exited assets, more than four times what was held during the global financial crisis.

“That has precipitated a liquidity crunch for limited partners that has contributed to the industry’s abrupt skid in fundraising over the past 12 months,” the Bain report stated.

A steep drop in fund launches is expected this year, according to S&P Global Market Intelligence and Preqin data released in July, which indicated a weak first half with only 319 private equity and venture capital funds entering the market. According to S&P, fund managers would need to launch five times as many funds in the second half of 2023 to match last year’s total of 1,946 fund launches. The analyst also noted that if the first-half figures are repeated during the second half, fund launches will have decreased 67.2% from 2022.