| | SLO | ENG | Cookies and privacy

Bigger font | Smaller font
First page > Show document

Show document Help

Title:Analiza poročanja o kibernetskih tveganjih v letnih poročilih slovenskih podjetij
Authors:ID Meh, Lara (Author)
ID Zdolšek, Daniel (Mentor) More about this mentor... New window
Files:.pdf UN_Meh_Lara_2025.pdf (2,47 MB)
MD5: 3E7C2A3F8738859E5D8EC4DE01F086BF
 
Language:Slovenian
Work type:Bachelor thesis/paper
Typology:2.11 - Undergraduate Thesis
Organization:EPF - Faculty of Business and Economics
Abstract:Diplomsko delo se posveča vprašanju, koliko slovenska podjetja v svojih letnih poročilih razkrivajo kibernetska tveganja ter ukrepe za zagotavljanje kibernetske varnosti. Namen raziskave je ugotoviti raven razkrivanja kibernetskih tveganj. Podjetja se soočajo z vse bolj kompleksnimi kibernetskimi tveganji, ki ne izvirajo zgolj iz zunanjih virov (kot so npr. vdori v e-poštna sporočila, zlonamerna programska oprema, spletne prevare) , temveč tudi iz notranjega okolja, kot so napake zaposlenih ali zlonamerna dejanja. V diplomskem delu smo opredelili kibernetska tveganja in kibernetsko varnost kot sestavni del upravljanja tveganj. Prestavili smo notranje in zunanje grožnje za podjetja ter veljavno zakonodajo in evropsko regulativo, prav tako pa tudi podlago za razkrivanje tveganj v letnih poročilih podjetij. Predstavili smo tudi nekatere dobre in slabo prakse razkrivanja tveganj z zgledi. Izvedli smo empirično raziskavo, in sicer za 30 izbranih podjetij (15 velikih in 15 srednje velikih podjetij) smo analizirali razkritja v njihovih letnih poročilih za obdobje 2021–2023. Preverili smo, ali podjetja zaznavajo tveganja na splošno, tveganja v zvezi z informacijsko varnostjo ter tveganj v zvezi s kibernetsko varnostjo. Tveganja so razkrita v vseh letnih poročilih, kibernetska tveganja je razkrivalo 35 % vseh letnih poročil, informacijsko varnost pa kar 53 %. Torej kibernetska tveganja je razkrivalo 6 od 30 izbranih podjetij (podjetja so kibernetska tveganja razkrivala vsaj v dveh letnih poročilih). Informacijsko varnost pa je razkrivalo 16 od 30 izbranih podjetij. Najbolj so razkrivala tveganja velika podjetja, zlasti tista, ki kotirajo na borzi ali delujejo v panogah energije ali telekomunikacij. Srednje velika podjetja iz manj tveganih panog razkrivajo bistveno manj, pogosto pa se omejijo zgolj na osnovna razkritja o tveganjih. Prvo hipotezo, da večina podjetij kibernetskih tveganj ne razkriva, smo lahko potrdili, saj le 35 % letnih poročil vsebuje omembe o kibernetskih tveganjih (le 7 od 30 podjetij je vsaj v enem letnem poročilu v izbranem obdobju razkrivalo kibernetska tveganja). Drugo hipotezo, da vsaj tretjina podjetij razkriva kibernetski napad, smo zavrnili, saj je le eno podjetje od tridesetih podjetij razkrilo tak napad. Tretjo hipotezo, da obstajajo razlike glede na velikost/panogo podjetja, smo potrdili, saj je prihajalo do večjih razlik med podjetji. Ugotavljamo, da večina podjetij tematiki razkritij še vedno ne posveča zadostne pozornosti. Le redka podjetja kibernetska tveganja celovito vključujejo v svoja razkritja, zato je potreba po večji zakonodajni jasnosti, izobraževanju zaposlenih ter sistematičnem vključevanju upravljanja kibernetskih tveganj v strateške dokumente podjetij. V prihodnje bi bilo zanimivo proučevati letna poročila podjetij, katerih kibernetski napad je bil poročan v medijih. Tako bi lahko ugotovili, če so in kako so to podjetja razkrivala v svojih letnih poročilih. Smiselno bi bilo čez nekaj let narediti tudi analizo, kako so se spremenila razkritja v letnih poročilih podjetja v vzorcu zaradi novih regulativnih zahtev s področja informacijske varnosti.
Keywords:kibernetska varnost, kibernetsko tveganje, nevarnosti informacijske tehnologije, strategije obvladovanja kibernetskih tveganj, poročanje kibernetskih tveganj, letno poročilo
Place of publishing:Maribor
Publisher:L. Meh]
Year of publishing:2025
PID:20.500.12556/DKUM-94582 New window
UDC:657:004.056
COBISS.SI-ID:254601987 New window
Publication date in DKUM:24.10.2025
Views:131
Downloads:48
Metadata:XML DC-XML DC-RDF
Categories:EPF
:
Copy citation
  
Average score:(0 votes)
Your score:Voting is allowed only for logged in users.
Share:Bookmark and Share



Hover the mouse pointer over a document title to show the abstract or click on the title to get all document metadata.

Licences

License:CC BY-NC-ND 4.0, Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International
Link:http://creativecommons.org/licenses/by-nc-nd/4.0/
Description:The most restrictive Creative Commons license. This only allows people to download and share the work for no commercial gain and for no other purposes.
Licensing start date:21.08.2025

Secondary language

Language:English
Title:Analysis of cybersecurty risk reporting in annual reports of slovenian companies
Abstract:The thesis focuses on the question of how much Slovenian companies disclose cyber risks and measures to ensure cybersecurity in their annual reports. The purpose of the research is to determine the level of cyber risk disclosure. Companies are facing increasingly complex cyber threats, which do not only originate from external sources (such as email breaches, malware, online fraud) but also from internal environments, such as employee errors or malicious actions. In the thesis, we defined cyber risks and cybersecurity as integral parts of risk management. We presented both internal and external threats to companies, the applicable legislation and European regulation, as well as the basis for risk disclosure in companies’ annual reports. We also presented some good and bad practices of risk disclosure with examples. An empirical study was conducted on 30 selected companies (15 large and 15 medium-sized), analyzing disclosures in their annual reports for the period 2021–2023. We examined whether companies identify risks in general, risks related to information security, and risks related specifically to cybersecurity. Risks were disclosed in all annual reports; however, cyber risks were disclosed in only 35% of all reports, and information security in 53%. This means that 6 out of 30 selected companies disclosed cyber risks (these companies disclosed such risks in at least two annual reports). Information security was disclosed by 16 out of 30 selected companies. Risk disclosure was most prevalent among large companies, especially those listed on the stock exchange or operating in the energy or telecommunications sectors. Medium-sized companies from less risk-exposed industries disclosed significantly less and often limited themselves to basic risk disclosures. The first hypothesis – that most companies do not disclose cyber risks – was confirmed, as only 35% of the annual reports mentioned cyber risks (only 7 out of 30 companies disclosed cyber risks in at least one annual report during the selected period). The second hypothesis – that at least one-third of companies disclose a cyberattack – was rejected, as only one out of thirty companies disclosed such an incident. The third hypothesis – that there are differences based on the size/industry of the company – was confirmed, as there were significant differences among companies. We conclude that most companies still do not pay sufficient attention to the topic of disclosures. Only a few companies comprehensively include cyber risks in their reporting, indicating a need for greater legislative clarity, employee education, and systematic inclusion of cyber risk management in companies’ strategic documents. In the future, it would be interesting to study the annual reports of companies whose cyberattacks were reported in the media. This would help determine whether and how those companies disclosed the incidents in their annual reports. It would also be meaningful to conduct an analysis in a few years to see how disclosures in annual reports have changed due to new regulatory requirements in the field of information security.
Keywords:cyber security, cybersecurity risk, risks of infomation technology, strategies for managing cyber risks, reporting of cyber risks, annual report


Comments

Leave comment

You must log in to leave a comment.

Comments (0)
0 - 0 / 0
 
There are no comments!

Back
Logos of partners University of Maribor University of Ljubljana University of Primorska University of Nova Gorica