Cybersecurity: investing for competitive outcomes. Issue 1 (26th October 2020)

• Record Type: Journal Article
• Authors: Kosutic, Dejan; Pigni, Federico
• Is Part Of: Journal of business strategy. Volume 43:Issue 1(2022)
• Page Start: 28
• Page End: 36
• Publication Date: 2020-10-26
• Subjects: Cybersecurity -- Competitive advantage -- Dynamic capabilities -- Operational capabilities -- Resource-based view -- Information security -- Socio-technical model; Business planning -- Periodicals; 658.4005
• DOI: 10.1108/JBS-06-2020-0116
• Languages: English
• ISSNs: 0275-6668

Abstract

Abstract : Purpose: The purpose of this paper is to help companies address the problem of ever-increasing cybersecurity investment that does not produce tangible business value – this is achieved by explaining the relationship between cybersecurity and competitive advantage. Design/methodology/approach: The impact of cybersecurity on competitive advantage was explored through a qualitative research study – the authors conducted an extensive literature review and conducted two rounds of semi-structured interviews with executives and security professionals from companies in four countries, from the financial, IT and security industries. Findings: The analysis of the findings enabled the conceptualization of the Cybersecurity Competitive Advantage Model that explains how to build up cybersecurity dynamic capabilities to achieve long-term competitive advantage. Research limitations/implications: The research presents the theorization of the model based on an extensive literature review, gathered information, insight from qualified respondents and the authors' experience in the field. While we controlled for saturation and rigorously collected and analyzed the data, the inductive approach followed may limit the generalizability of the findings. Practical implications: The proposed model helps explain to executives how to differentiate their company in a novel way and how to retain that competitive advantage; security professionals can use the model to organize cybersecurity and communicate to their superiors more effectively. Originality/value: The presented model differs from existing literature, cybersecurity frameworks and industry standards by presenting a method of avoiding technological bias and for achieving competitive advantage.