Quantifying fear of hackers with AI for predicting Cybersecurity returns

4 min readJul 16, 2021


“Company X attacked by ransomware, hackers demand Y million USD”. A headline that is pretty common these days. And for those working in large cap companies the response on the work floor is pretty similar, suddenly the IT departments main focus is cyber security. This tells us something behavioural economists already recognized for a while and which they call availability bias. Availability bias shows that people overestimate the probability of an accident after they just witnessed a car crash. Or that they overestimate the probability of a cyber attack after they just read about yet another ransomware attack…

This is all academically and psychologically very interesting but to investors (myself included) it is only interesting when there is some way to take advantage. We have a novel approach to doing just that. In order to explain this approach we want to take one step back and explain the quantitative narrative model we have built.

How stories impact stock returns

Academics are recognizing more and more that stories matter, also in capital markets (Eg Robert Shiller — Narrative Economics). We build a model to quantify narratives. We do this by using alternative data (a lot of financial headlines, tweets, comments etc) and machine learning (for recognizing topics and sentiment of this data). In this way we can track which story or narrative is getting increased attention and see if that is positive or negative).

Now back to our hackers and behavioural pitfalls. Since we can measure if some narrative is trending and for what reasons, we can also see if financial news, chatter and/or commentary is growing more fearful of hackers. And if so, we hypothesise that this will lead to increase attention to and investment in cybersecurity.

From theory to practice

To test whether this is true ran our model on hacker and ransomware specific topics. First, we quantity the narratives on whether there is more attention on this topic (exposure), whether there is more negative exposure or fear of cyber attacks (negative exposure), what is the difference between positive negative attention on cyber attacks. Following on this we established the beta of these metrics relative to future (lagged) returns on a Cyber Security etf (ISPY.MI). These betas are in line with logical intuition, namely:

· If exposure of cyberattacks increases, future returns of ISPY.MI also increases

· If the difference between positive and negative sentiment (pos/neg diff) towards cyber attacks is getting more positive (ie less fearful) returns decrease

· If fear (negative exposure) increases future returns increase

Having established the relation between Cyberattack narratives and ISPY.MI we have an interesting indicator on whether to invest or not in cybersecurity etfs. The calculated beta is calculated on 5 to 15 days lags. This makes the horizon somewhat unique in that this approach does not establish a relation for long term horizons and short term horizon but rather a medium term horizon. This can be useful in timing entries and exits, as well as warning indicator for extreme movements. Our model reports the (change in) most recent observations of mentioned metrics in a topic specific dashboard which can be found here: https://narrative-investing.io/reports/narrative_report_Hack.html. Currently the values (reported under “recent_val”) indicate a future upward movement of ISPY.MI

Adding more narratives

This analysis of ISPY.MI only uses one narrative as explanatory variable (that of Cyberattacks). But why stop there? With our model we can handle more narratives as explanatory variables. Next to Cyberattacks also general economic sentiment and tech sentiment will probably be of influence. And why only use beta’s for clarifying relations? Our model are also able to handle more sophisticated machine learning techniques that can capture non-linearity and are more robust. So we added some more narratives and used machine learning (Random Forest for those familiar with the material) to give a prediction, along with an analysis on which narrative seem to me most important in prediction future returns. One can find this analysis presented as interactive dashboard on https://narrative-investing.io/reports/narrative_report_tech_net-ISPY.MI.html .

What we find here is that future returns of ISPY.MI is influenced by many more narratives than only the fear of hacks. Amongst others we find economy related news, tech related news (and fear) and the balance between financial emotional chatter (difference between negative and positive financial texts) influence ISPY.MI

Concluding this narrative

With this analysis we hope to give some insight in how narratives in general and the fear of cyberattacks in specific can influence future returns. As the horizon of this analysis is medium term we constantly will the analysis by monitoring developments in relevant narratives. Moreover the idea of investing on by analysing narratives lends itself to other tickers, so expect other analyses in the near future.




Hoping to add some creative ways of looking at quantitative finance


See more recommendations