Most IT security professionals are aware of the damaging influence a major incident can have on brand value and company reputation. But it doesn't have to be that way. At this week's MISTI CISO summit in Orlando, several presenters expressed amazement that the stock of price of TJ Maxx had increased after last year's highly publicised data breach. But it was no surprise to me.
Anyone who has studied the aftermath of company crises will appreciate that heavy media coverage is also free advertising. If you handle a crisis well you will come out on top. Academic research by Deborah Pretty at Oxford University several years ago confirmed this counter-intuitive phenomenon.
Any organisation that spends millions of dollars on security consultancy and fixes following an incident gives me confidence. I'd rather trust a product from a company that's been hit and learned a lesson, rather than one that might have just been lucky. And clearly the stock markets also think that way.