BIS: Cyber stress tests boost bank cybersecurity investment
A Bank for International Settlements (BIS) working paper finds that targeted supervisory scrutiny, such as cyber stress tests, significantly increases cybersecurity investment among underinvesting banks. European 'laggard' banks boosted spending by 80% after the ECB's 2024 Cyber Resilience Stress Test announcement.
Disciplining the laggards
The study identifies 'laggard' European banks that underinvest in cybersecurity relative to their risk profiles, using confidential supervisory data from the European Central Bank.
By exploiting the 2024 ECB Cyber Resilience Stress Test (CyRST) as a quasi-natural experiment, researchers found that following the CyRST announcement, these laggard banks increased their cybersecurity investment by approximately 80% compared to their peers.
This response was particularly strong among laggards subject to high-intensity supervisory oversight, demonstrating a clear disciplining effect.
The CyRST was purely qualitative, with no direct capital implications or public disclosure of individual bank results, allowing the study to isolate the 'scrutiny channel' as the primary mechanism driving this behavioral change.
This suggests that the credible threat of direct examination, rather than formal penalties or market discipline, can effectively motivate banks to enhance their operational risk management.
Cybersecurity as a public good
Cyber risk poses a significant operational and systemic threat to the global financial system, with localized attacks capable of rapid propagation across interconnected networks.
Cybersecurity investments, while providing private operational benefits, also generate positive externalities, meaning a better-protected bank reduces systemic risk for all.
This public-good property often leads to systemic underinvestment, as banks internalize only a portion of the broader benefits.
This underinvestment problem creates a crucial role for supervisory intervention, particularly when traditional tools like capital consequences or market discipline through disclosure are not directly applied.
Beyond capital and disclosure
This research provides novel causal evidence that non-capital-based stress tests can effectively discipline underinvestment in critical operational risks.
It highlights the potent 'scrutiny channel' as a distinct mechanism for influencing bank behavior, complementing traditional regulatory tools.
For supervisors, this suggests a valuable approach to strengthen financial system resilience in areas where risks are hard to quantify and evolve rapidly.