Is the Market Value of Software Vendors Affected by Software Vulnerability Announcements

Nowadays, information security constitutes an urgent issue for businesses and researchers. The security vulnerabilities existing in computer systems are sources of different problems. An indirect and emerging issue, regarding the economic consequences of the vulnerabilities, is the impact of software vulnerability announcements to the stock price of the responsible software vendors. The scope of this paper is the study of the stock market reaction when vulnerability announcements occur and the correlation analysis between the impact of these events and vulnerability severity according to scoring systems. To find the impact to the stock market, the well-established in economics event study methodology was used. The dataset in this research was collected from the US-CERT (United States Computer Emergency Readiness Team) website, consisting of year’s 2014 records while the total number of vulnerability announcement events is 75. The results show a slight but not statistically significant negative impact of such events to the stock price of the corresponding firms.