Disciplining digital risk: evidence from cyber stress tests

Nordine Abidi, Leonardo Gambacorta, Christoffer Kok, Leonardo Madio, Ixart Miquel-Flores and Alberto Partida

No 1351, BIS Working Papers from Bank for International Settlements

Abstract: Investment in cybersecurity in an interconnected banking system has public-good properties: positive externalities can generate systemic underinvestment. Using confidential supervisory data from the European Central Bank, we first identify "laggard" European banks that underinvest relative to their cyber-risk profiles, and then examine how supervisory scrutiny affects their incentives to invest. We exploit the 2024 ECB Cyber Resilience Stress Test (CyRST) as a quasi-natural experiment. In a difference-in-differences design, we find that following the CyRST announcement, laggard banks increased cybersecurity investment by about 80% relative to their peers. The response is stronger among laggards subject to high-intensity supervisory oversight, consistent with scrutiny exerting a disciplining effect. Overall, the results suggest that targeted supervisory scrutiny may help mitigate underinvestment incentives and strengthen banks' operational risk management.

Keywords: cyber risk; bank supervision; stress test; IT investment (search for similar items in EconPapers)
JEL-codes: G21 G28 G32 K23 L86 (search for similar items in EconPapers)
Date: 2026-05
References: Add references at CitEc
Citations:

Downloads: (external link)
https://www.bis.org/publ/work1351.pdf Full PDF document (application/pdf)
https://www.bis.org/publ/work1351.htm (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:bis:biswps:1351

Access Statistics for this paper

More papers in BIS Working Papers from Bank for International Settlements Contact information at EDIRC.
Bibliographic data for series maintained by Martin Fessler ().