Disciplining digital risk: evidence from cyber stress tests

Nordine Abidi, Leonardo Gambacorta, Christoffer Kok, Ixart Miquel-Flores, Leonardo Madio and Alberto Partida

No 3222, Working Paper Series from European Central Bank

Abstract: Investment in cybersecurity in an interconnected banking system has public-good proper- ties: positive externalities can generate systemic underinvestment. Using confidential supervi- sory data from the European Central Bank, we first identify “laggard” European banks that underinvest relative to their cyber-risk profiles, and then examine how supervisory scrutiny af- fects their incentives to invest. We exploit the 2024 ECB Cyber Resilience Stress Test (CyRST) as a quasi-natural experiment. In a difference-in-differences design, we find that following the CyRST announcement, laggard banks increased cybersecurity investment by about 80% rel- ative to their peers. The response is stronger among laggards subject to high-intensity su- pervisory oversight, consistent with scrutiny exerting a disciplining effect. Overall, the results suggest that targeted supervisory scrutiny may help mitigate underinvestment incentives and strengthen banks’ operational risk management. JEL Classification: G21, G28, G32, L86, K23

Keywords: bank supervision; cyber risk; IT investment; stress test (search for similar items in EconPapers)
Date: 2026-05
Note: 1847506
References: Add references at CitEc
Citations:

Downloads: (external link)
https://www.ecb.europa.eu//pub/pdf/scpwps/ecb.wp3222~27c5b77e07.en.pdf (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:ecb:ecbwps:20263222

Access Statistics for this paper

More papers in Working Paper Series from European Central Bank 60640 Frankfurt am Main, Germany. Contact information at EDIRC.
Bibliographic data for series maintained by Official Publications ().