Romanian Cyber Security Journal / Spring 2026, No. 1, Vol. 8

Assessing the Impact of ESG and Cybersecurity on Firm Value

Loredana PAMFILE

---

Abstract

ESG has moved from buzzword to regulatory baseline. Investors expect it. Regulators require it. Society now sees sustainability as a relevant standard to adhere to and as a condition of legitimacy. Yet as companies deepen their ESG commitments through digital infrastructure, cybersecurity has emerged as a hidden fault line. A breach can erode firm value as swiftly as a financial crisis. This study examines whether ESG performance affects firm value among European-listed companies (2017-2024) and investigates whether cybersecurity governance moderates that relationship. The study used a two-way fixed effects panel framework applied to 13,329 firm-year observations across 2,192 firms from 28 countries and 11 industries. The analysis reveals a striking divergence between surface and substance. A strong cross-sectional ESG premium (specifically, high-ESG firms outperforming by +5.6 ROA percentage points) disappears once firm heterogeneity is controlled for (β=−0.0002, p=0.498), consistent with a selection effect rather than a causal ESG premium. Governance quality, proxied by Refinitiv’s Governance score, which encompasses IT governance and cybersecurity disclosure, marginally moderates the ESGROA relationship (β=+1.21×10⁻⁵, p=0.096), suggesting that firms with stronger cybersecurity and governance frameworks are better positioned to convert ESG engagement into financial value. Board structure strongly predicts ESG adoption (within-R²=19.8%), supporting a two-stage narrative in which governance both drives ESG adoption and determines whether it translates into value creation. These findings carry practical weight for investors, managers, and regulators working to embed cybersecurity into ESG frameworks.

Keywords

Cybersecurity, Panel Data, ESG, Sustainability, Corporate Governance, Firm Performance