Measuring Cybersecurity Investment Effectiveness: Linking Risk Reduction Metrics to Digital Transformation Value Outcomes

Abstract

In emerging markets, the strategic conundrum is similar, with financial institutions investing big in cybersecurity and lacking a clear path to measurement of impact on outcomes of digital transformation at the firm level. With the theory and insights provided by Resource Based View and the economics-of-information-security stream pioneered by Gordon and Loeb, this study proposes and tests a mediating model framework that sets cybersecurity investment intensity as the independent variable and digital transformation value as the dependent variable, with the metrics of risk reduction as the mediator. The study employed hierarchical multiple regression and bootstrapped mediation analysis in SPSS using a cross-sectional survey of 500 information technology and risk management professionals in Nigeria, comprising professionals from deposit money banks, merchant banks, microfinance banks, and payment service banks/fintech operators. Exploratory factor analysis provided preliminary evidence of a clear three-factor solution, with good sampling adequacy (KMO = .933) and satisfactory internal consistency across the constructs (Cronbach's α = .77–.88). Digital transformation value was positively related to investment intensity of cybersecurity (beta = .358, p < .001), and the indirect effect through risk reduction metrics was statistically significant (indirect effect = .159, 95% bootstrap CI [.116, .206]), accounting for approximately 44.2% of the total effect and indicating partial mediation. The results indicate that cybersecurity investment intensity is positively associated with digital transformation value, with risk reduction providing an important mechanism through which cybersecurity investment may be translated into measurable organizational value. The study provides empirically supported quantitative measures linking cybersecurity investment, risk reduction, and digital transformation value and provides a roadmap for Nigerian financial institutions to support and prioritize spending on cybersecurity based on measurable milestones for reduction of risks. Common-method limitations as well as directions for longitudinal and multinational replication are discussed