Cybersecurity Harm Without Breach: Legal Accountability for Invisible and Latent Cyber Risks.

The prevailing legal paradigm for cybersecurity liability is predicated on a 'catastrophic' model of harm, where liability attaches only upon the materialisation of a data breach. This 'breach-centric' orthodoxy fails to account for the invisible, latent, and systemic risks inherent in modern digital ecosystems risks that exist in the 'dwelling' phase of an attack long before exfiltration occurs. This article challenges the doctrinal insistence on 'concrete injury' in US jurisprudence (the Spokeo/TransUnion lineage) and contrasts it with the actuarial reality of the cyber-insurance market, which actively prices latent risks such as 'bricking,' 'dormant malware,' and 'resilience debt.' Drawing on Ulrich Beck's 'Risk Society' theory and an empirical analysis of 50 insurance coverage disputes, this research introduces a novel theoretical framework: 'Resilience Liability.' This framework argues that the maintenance of an indefensible security posture constitutes an actionable injury per se. By shifting the legal focus from the 'event' of the breach to the 'condition' of insecurity, this article proposes a normative realignment of tort law to address the 'silent' harms of compromised integrity, ensuring that invisible risks do not translate into unredressed societal externalities.