Publicly Disclosed Corporate Security Governance in Critical-Service Firms: Accountability Structures and Disclosure-Specificity Signals

In the modern world, certain companies hold a unique position: they run the essential systems that keep society moving. These are the firms that power our lights, move our trains, connect our digital networks, and manage the flow of money. Because their work is so vital, governments and the public expect them to be safe, resilient, and ready for trouble. To ensure this, these companies are asked to manage risks carefully and to tell the public how they are doing it. This public telling is called disclosure. It is the act of writing down what a company plans to do, who is in charge, and how they check their work. However, there is a crucial difference between writing a plan and actually following it. A company can publish a detailed document about safety without having a safe system in place, just as a person can write a promise to exercise without ever stepping into a gym. The challenge for outside observers is that they cannot walk inside these companies to see the real machinery. They can only read the documents the companies choose to share. This creates a gap between what is said and what is done, a gap that researchers must navigate carefully to understand the true state of corporate safety.

A recent study by Karim Hardy, a researcher at the École Nationale Supérieure des Mines de Paris, set out to map exactly what these essential companies are saying in their public reports. The study focused on twenty-four listed companies across Europe that provide critical services like energy, transport, digital infrastructure, and banking. The researcher gathered thirty-one public documents from these firms, mostly their annual reports for the year 2025, and read them with a very specific set of questions in mind. Instead of trying to guess how well these companies were actually performing, the study asked a simpler, more precise question: how specific are the companies when they talk about their safety rules? The researcher looked for ten different areas of safety management, ranging from who sits on the board to oversee security, to how they handle suppliers, and how they learn from mistakes. Each mention in the documents was sorted into one of four levels of detail. The lowest level was a vague promise to be safe. The next level was naming a specific person or group in charge. The highest level was a clear description of a working system that included checks, feedback, and a way to measure success.

The results revealed a clear pattern in what these companies are willing to share. The most consistent and detailed information found in the reports concerned how safety risks are connected to the company's overall business strategy. Almost every single company, twenty-three out of twenty-four, described a specific, named process for integrating security into their main risk management plans. They clearly stated who was responsible and how this fit into the bigger picture. This suggests that for these firms, talking about the connection between security and business strategy has become a standard, well-defined practice in their public writing. However, the picture changed dramatically when the researcher looked at how these companies manage their outside partners and suppliers. This area, known as third-party governance, was the least likely to be described with specific details. While sixteen companies mentioned some level of oversight for their suppliers, five companies did not mention it at all in the documents reviewed. Even among those that did, the descriptions were often less detailed than those for internal strategy. This does not mean these companies are failing to manage their suppliers; it simply means that the public documents do not show the same level of specific detail for this part of their work as they do for their internal planning.

The study also examined whether these companies fell into distinct, predictable groups, such as "strategy-focused" firms or "resilience-focused" firms. The researcher looked for recurring combinations of detailed disclosures to see if a stable type of company emerged. While some patterns appeared frequently, such as companies that were strong in both internal strategy and external reporting, these patterns overlapped too much to create neat categories. A company could be strong in one area and weak in another without fitting a single label. The research concluded that trying to force these companies into rigid types would be misleading. Instead, the most honest description is that these firms share a common language for talking about their internal safety plans, but they vary significantly in how much they reveal about their external relationships.

A significant finding of the study was the source of the information itself. The researcher discovered that almost all the specific details found in these reports were tied to cyber security and information technology. When the researcher removed any mention of computers, data, or digital networks from the analysis, the amount of usable information dropped drastically. Out of the hundreds of specific details found, only a small fraction remained that were not explicitly about digital security. This suggests that when these companies talk about safety in their public reports, they are mostly talking about digital threats. Other important aspects of security, such as physical protection of buildings, fraud prevention, or crisis management for non-digital events, were far less visible in the documents. This does not mean those other areas are ignored, but it does mean that the public record is heavily skewed toward the digital world.

The study was careful to draw a strict line between what was written and what was happening. The researcher emphasized that finding a detailed description in a report does not prove that the system works well in reality. A company can write a perfect plan and still fail to execute it. Conversely, a company might have a robust system in place but choose not to describe it in detail in its public report. The study did not measure safety, resilience, or effectiveness. It only measured the specificity of the words used in the public documents. By keeping this boundary clear, the research provides a reliable map of what is visible to the public, without making assumptions about what lies behind the closed doors of these essential organizations. The work serves as a reminder that while public reports offer a window into corporate governance, that window shows only what the company chooses to display, and often, that display is focused heavily on the digital realm.