Cybersecurity guarantees: Conceptualizing and testing a promise to support customers in case of data breach
(A2026-132624)

AUTHORS

Paolo ANTONETTI, EDHEC Business School; ILARIA BAGHI, University of Modena and Reggio Emilia; Gabriele Pizzi, University of Bologna

ABSTRACT

This study argues that organizations have a moral obligation to inform customers about the level of support they can expect in case of a data breach. Drawing from the service guarantee literature, we propose that privacy statements include a cybersecurity guarantee specifying such support. A contractualist ethical framework suggests this duty for three reasons: (1) informed consent requires knowledge of cybersecurity risks and their management; (2) organizations have a duty of care, reinforced by customers’ continued ownership of personal data and the corporate use of that data for profit; and (3) organizations must foster trust in collective cybersecurity stewardship through transparent communication. A preliminary empirical study supports these arguments, showing that a cybersecurity guarantee reduces customers’ perceived risk and anxiety when sharing data with online retailers. The study extends research on privacy statements and corporate digital responsibilities.