From Aniket Baksy and Daniele Caratelli, here is part of the abstract:

Because larger firms are more attractive targets but also invest more in protection, the model generates an inverse-U relationship between firm size and attack risk, consistent with the data. Introducing cyber risk reduces firm entry by 3.6 percent, aggregate productivity by 0.6 percent, and total output by 1.8 percent. These effects arise from general equilibrium adjustments in entry, firm size, and spillovers that are absent in typical partial-equilibrium analyses. Policy responses differ sharply: appropriately designed subsidies and minimum cybersecurity requirements can raise aggregate output, while bailouts reduce it.

Note this is not a paper about AI.  But it may help us develop estimates of the future costs of AI cyberattacks.  We need much more effort in this direction, and I hope this subfield rises in status rapidly.