Disciplining Digital Risk: Evidence from Cyber Stress Tests

Nordine Abidi, Leonardo Gambacorta, Christoffer Kok, Leonardo Madio, Ixart Miquel Flores and Alberto Partida

No 21604, CEPR Discussion Papers from Centre for Economic Policy Research

Abstract: Investment in cybersecurity in an interconnected banking system has public-good properties: positive externalities can generate systemic underinvestment. Using confidential supervisory data from the European Central Bank, we first identify “laggard†European banks that underinvest relative to their cyber-risk profiles, and then examine how supervisory scrutiny affects their incentives to invest. We exploit the 2024 ECB Cyber Resilience Stress Test (CyRST) as a quasi-natural experiment. In a difference-in-differences design, we find that following the CyRST announcement, laggard banks increased cybersecurity investment by about 80% relative to their peers. The response is stronger among laggards subject to high-intensity supervisory oversight, consistent with scrutiny exerting a disciplining effect. Overall, the results suggest that targeted supervisory scrutiny may help mitigate underinvestment incentives and strengthen banks’ operational risk management.

Keywords: Cyber risk; Bank supervision; Stress test; IT investment (search for similar items in EconPapers)
JEL-codes: G21 G28 G32 K23 L86 (search for similar items in EconPapers)
Date: 2026-06
References: Add references at CitEc
Citations:

Downloads: (external link)
https://cepr.org/publications/DP21604 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:cpr:ceprdp:21604

Ordering information: This working paper can be ordered from
https://cepr.org/publications/DP21604

Access Statistics for this paper

More papers in CEPR Discussion Papers from Centre for Economic Policy Research 33 Great Sutton Street, London EC1V 0DX, UK.
Bibliographic data for series maintained by CEPR ().