Cybersecurity The New Frontier of ESG Risk

The New Frontier of ESG Risk Yannick Ouaknine Nimit Agarwal Smita Kar Kevin Redureau Head of Sustainability Research Senior Sustainability Strategist Sustainability Strategist Equity Strategist (Europe)

Synopsis of Cybersecurity - The New Frontier of ESG Risk (37p) report published on 3 September 2026

Societe Generale (“SG”) does and seeks to do business with companies covered in its research reports. As a result, investors should be aware that SG may have a conflict of interest that could affect the objectivity of this report. Investors should consider this report as only a single factor in making their investment decision. PLEASE SEE APPENDIX AT THE END OF THIS REPORT FOR THE ANALYST(S) CERTIFICATION(S), IMPORTANT DISCLOSURES AND DISCLAIMERS. ALTERNATIVELY, VISIT OUR GLOBAL RESEARCH DISCLOSURE WEBSITE

EXECUTIVE SUMMARY - FIVE KEY TAKEAWAYS

The nature of the threat has changed, not just the scale Global cybercrime cost estimated at $1.2tn to $10.5tn a year - the size of a G20 economy. Generative AI is the force multiplier: most phishing is now AI-generated, ~76% of malware is AI-polymorphic, and the first largely autonomous AI-run espionage campaign was documented in late 2025.

Cyber risk is now a key factor in geopolitics WEF ranks geoeconomic confrontation as the top short-term global risk; NATO has clarified that significant cyberattacks may be treated as equivalent to an armed attack under Article 5. The JLR (£1.9bn), UK retail, and Poland grid attacks showed macro-scale transmission.

Regulation is moving from disclosure to liability 2026 is the enforcement year: DORA supervision live, NIS2 deadlines, CRA incident reporting from 11 Sep 2026, AI Act high-risk rules from Aug 2026; SEC 4-day reporting and Reg S-P bind US boards from June 2026.

Cybersecurity is the missing pillar in 'S' and 'G' Hospital ransomware, grid intrusions and mass data theft are social harms with identifiable victims. Board oversight is now a proxy-advisor expectation, yet disclosure remains thin - a measurable, closable governance gap.

Investment implications: the SG Cybersecurity Index SGIXCYSE (25 stocks) is up +36.2% ytd vs +16.2% for the Nasdaq 100; trading at 24.1x forward earnings (10% premium vs 20% on average) with a more resilient EPS growth profile to 2028.

Source: SG Cross Asset Research / Sustainability, WEF, European Commission, Bloomberg, company reporting