Corporate Finance

We study how cybersecurity vulnerabilities affect firm performance. We analyze 551 open-core software firms from 2010 to 2025, comparing firms affected by vulnerability discoveries with unaffected firms. These discoveries concern third-party dependency packages, making their timing plausibly exogenous to the firms using them. Exposed firms experience approximately 10% slower headcount growth relative to their pre-treatment average and a 1.7 percentage point decline in acquisition probability. Developer activity shifts toward remediation: the share of non-remediation work falls by 2.8 percentage points, while elevated fix-related activity persists for twelve months. These changes accompany faster accumulation of technical debt and cognitive complexity, which grow approximately 20 and 16–21 percentage points faster, respectively. Together, the findings suggest that cybersecurity vulnerabilities can disrupt firm growth and place persistent demands on engineering resources.