Alpha-Centric ESG Research

Kyle Rudden

I am an ESG (Environmental, Social, Governance) analyst with an alpha-centric approach to ESG research. After all, ESG investing is, first and foremost, investing. "Alpha-centric" does not mean apathetic, however. Quite the contrary. I believe global sustainability – i.e., environmental stewardship, social equality, and economic prosperity – is imperative, and private-sector capital is its cornerstone. Private-sector capital still has fiduciary responsibilities. Profitability is necessary for sustained impact. The Triple Bottom Line. People, Planet, AND Profit.

More importantly, you. I value your investment in Smartkarma research, and commit to Insights worthy of your time and money. That means giving ASEAN ESG the attention it deserves, and with Insights that are substantive and differentiated; the intersection of material and under-covered. You can expect investigative research into emergent ESG issues; data-driven analyses of deals (pre-IPO ESG research, ESG-focused M&A consequence analyses, etc.); and trading-oriented ideas like ESG short selling and playing ESG index constituency changes.

I bring both ESG expertise and traditional investing experience, as well as some rather unique perspectives on ESG (a lesson in governance from Enron, anyone?). I spent the last decade exclusively on ESG, researching links to equity returns, credit ratings, cost of capital, and yield spreads. I also contributed to ESG reporting standards (SASB and GRI), and the MBA curriculum (Impact Investing) at the Kellogg School of Management. Previously, I was an Institutional Investor and Wall Street Journal All-Star sell-side analyst at J.P. Morgan.

Please, feel free to contact me about anything.

<blockquote><p><strong><em>Cybercrime is the greatest threat to every company in the world.</em></strong><br>                                                                    – Ginni Rommety, CEO, IBM</p></blockquote><p><em>Note: There is a pronounced ESG angle to this report but the underlying subject – i.e., cybersecurity as investment risk – is relevant beyond the ESG context. This also applies to future reports in this series.</em></p><div><div>Phishing, data breaches, ransomware, malware, DDoS attacks, and Armageddon-esque scenarios of global cyberwarfare, cascading blackouts, descent into anarchy, and rampant cannibalism.</div></div><div></div><div>But let's be realistic.</div><div></div><div>What matters to investors f<span>alls somewhere between a data breach and doomsday, at some rational intersection of probability and materiality. O</span><span>ne thing is clear though: Cyber-risk is a big deal.</span>
</div><div></div><p>Cybersecurity has emerged as a top ESG concern for institutional investors – and in some cases as <em>the</em> top ESG concern, ranking higher than even the most quintessential of E, S, and G topics.</p><div class="content-remarks"><p>In a recent <a href="https://global.rbcgam.com/sitefiles/live/documents/pdf/rbc-gam-responsible-investing-survey-key-findings-2019.pdf" target="_blank" rel="noopener">survey</a> by RBC Global Asset Management, institutional investors ranked cybersecurity as their number one ESG concern – ahead of ESG mainstays like climate change, diversity and equality, and anti-corruption.</p></div><p>In fact, cybersecurity is rapidly permeating the ESG ecosystem including reporting standards, ESG products (e.g., data, ratings, indexes), and ESG disclosure guidance by stock exchanges.</p><p>There's good reason for all the fuss.</p><p>ESG aside for a moment, cybersecurity is first and foremost a major source of general investing risk since cyber-attacks often result in serious business, financial and capital markets consequences.</p><p><span>We already knew that though.</span></p><p>And cybersecurity has been in the ESG lexicon for a while.</p><p>What's new is a palpable sense of urgency, coupled with a more sophisticated view of cybersecurity and how it fits into the overall ESG context. Salient summary points are as follows:</p><ul>
<li>An evolving cyber-threat landscape is pushing cyber-risk beyond familiar idiosyncratic risks – i.e., beyond the data breach – to include more abstract, complex, and malicious <em>systemic</em> risk.</li>
<li>For investors, greater levels of systemic cyber-risk, which is notoriously difficult to predict and manage, means more overall risk and a shift in its balance from security- to portfolio-level.</li>
<li>Certain kinds of systemic cyber-events, especially those affecting critical infrastructure sectors, can have dire Environmental, Social, and Governance impacts well beyond the affected issuers.</li>
<li>Cybersecurity Governance has been thrust into the ESG spotlight; from an obscure operational extra to a starring-role as a strategic concern demanding executive- and board-level oversight.</li>
<li>Not only is cybersecurity increasingly prominent on ESG agendas, but non-ESG organizations are looking at ESG reporting as an ideal framework for general cybersecurity disclosure.</li>
</ul><p>In short the cybersecurity/ESG story is one of: 1) issuer cyber-Governance, and 2) the societal ESG impacts of systemic cyber-events. It's a story best told through a series of sector-specific Insights.</p><p>My plan is to, periodically, cover systemic cyber-risk associated with critical infrastructure sectors (CIS), each in turn. The most imminent is on Utilities, with a pronounced Asia regional focus.</p><p>This report can stand on its own, but is intended as a contextual foundation for future reports.</p>

Cybercrime is the greatest threat to every company in the world.                                                                     – Ginni Rommety, CEO, IBMNote: There is a pronounced ESG angle to this report but the underlying subject – i.e., cybersecurity as investment risk – is relevant beyond the ESG context. This also applies to future reports in this series.Phishing, data breaches, ransomware, malware, DDoS attacks, and Armageddon-esque scenarios of global cyberwarfare, cascading blackouts, descent into anarchy, and rampant cannibalism.But let's be realistic.What matters to investors falls somewhere between a data breach and doomsday, at some rational intersection of probability and materiality. One thing is clear though: Cyber-risk is a big deal.
Cybersecurity has emerged as a top ESG concern for institutional investors – and in some cases as the top ESG concern, ranking higher than even the most quintessential of E, S, and G topics.In a recent survey by RBC Global Asset Management, institutional investors ranked cybersecurity as their number one ESG concern – ahead of ESG mainstays like climate change, diversity and equality, and anti-corruption.In fact, cybersecurity is rapidly permeating the ESG ecosystem including reporting standards, ESG products (e.g., data, ratings, indexes), and ESG disclosure guidance by stock exchanges.There's good reason for all the fuss.ESG aside for a moment, cybersecurity is first and foremost a major source of general investing risk since cyber-attacks often result in serious business, financial and capital markets consequences.We already knew that though.And cybersecurity has been in the ESG lexicon for a while.What's new is a palpable sense of urgency, coupled with a more sophisticated view of cybersecurity and how it fits into the overall ESG context. Salient summary points are as follows:
An evolving cyber-threat landscape is pushing cyber-risk beyond familiar idiosyncratic risks – i.e., beyond the data breach – to include more abstract, complex, and malicious systemic risk.
For investors, greater levels of systemic cyber-risk, which is notoriously difficult to predict and manage, means more overall risk and a shift in its balance from security- to portfolio-level.
Certain kinds of systemic cyber-events, especially those affecting critical infrastructure sectors, can have dire Environmental, Social, and Governance impacts well beyond the affected issuers.
Cybersecurity Governance has been thrust into the ESG spotlight; from an obscure operational extra to a starring-role as a strategic concern demanding executive- and board-level oversight.
Not only is cybersecurity increasingly prominent on ESG agendas, but non-ESG organizations are looking at ESG reporting as an ideal framework for general cybersecurity disclosure.
In short the cybersecurity/ESG story is one of: 1) issuer cyber-Governance, and 2) the societal ESG impacts of systemic cyber-events. It's a story best told through a series of sector-specific Insights.My plan is to, periodically, cover systemic cyber-risk associated with critical infrastructure sectors (CIS), each in turn. The most imminent is on Utilities, with a pronounced Asia regional focus.This report can stand on its own, but is intended as a contextual foundation for future reports.

Spirit Aerosystems Holdings, Inc (SPR US)

Saudi Aramco

Cybersecurity and ESG: Beyond the Breach