Template-Type: ReDIF-Paper 1.0
Author-Name: Nordine Abidi
Author-X-Name-First: Nordine
Author-X-Name-Last: Abidi
Author-Name: Leonardo Gambacorta
Author-X-Name-First: Leonardo
Author-X-Name-Last: Gambacorta
Author-Name: Christoffer Kok
Author-X-Name-First: Christoffer
Author-X-Name-Last: Kok
Author-Name: Leonardo Madio
Author-X-Name-First: Leonardo
Author-X-Name-Last: Madio
Author-Name: Ixart Miquel-Flores
Author-X-Name-First: Ixart
Author-X-Name-Last: Miquel-Flores
Author-Name: Alberto Partida
Author-X-Name-First: Alberto
Author-X-Name-Last: Partida
Title: Disciplining digital risk: evidence from cyber stress tests
Abstract: Investment in cybersecurity in an interconnected banking system has public-good properties: positive externalities can generate systemic underinvestment. Using confidential supervisory data from the European Central Bank, we first identify "laggard" European banks that underinvest relative to their cyber-risk profiles, and then examine how supervisory scrutiny affects their incentives to invest. We exploit the 2024 ECB Cyber Resilience Stress Test (CyRST) as a quasi-natural experiment. In a difference-in-differences design, we find that following the CyRST announcement, laggard banks increased cybersecurity investment by about 80% relative to their peers. The response is stronger among laggards subject to high-intensity supervisory oversight, consistent with scrutiny exerting a disciplining effect. Overall, the results suggest that targeted supervisory scrutiny may help mitigate underinvestment incentives and strengthen banks' operational risk management.
Creation-Date: 2026-05
File-URL: https://www.bis.org/publ/work1351.pdf
File-Format: Application/pdf
File-Function: Full PDF document
File-URL: https://www.bis.org/publ/work1351.htm
File-Format: text/html
Number: 1351
Keywords: cyber risk, bank supervision, stress test, IT investment
Classification-JEL: G21, G28, G32, L86, K23
Handle: RePEc:bis:biswps:1351