SUERF Policy Brief
Can supervisory scrutiny alone — without capital charges or public disclosure — shift bank behaviour on cybersecurity investment?
This SUERF Policy Brief, based on an ECB Working Paper, examines whether the ECB’s 2024 Cyber Resilience Stress Test (CyRST) induced banks to increase cybersecurity investment. Cybersecurity has become a central financial stability concern: because cyber resilience produces positive externalities across interconnected institutions, individual banks tend to underinvest relative to the social optimum — a problem that capital requirements and public disclosure are poorly suited to address.
Using confidential ECB supervisory data on 109 euro-area Significant Institutions over 2019–2024, the authors find that “laggard” banks — those that systematically underinvested relative to their risk profile before the CyRST announcement — raised cybersecurity investment by approximately 81% relative to peers following the March 2023 announcement, with no detectable pre-trends. The response is concentrated among the most severe laggards and those subject to the most intensive supervisory engagement, consistent with a scrutiny channel operating independently of capital penalties or market discipline. Beyond investment, laggard banks also reduced external ICT outsourcing, modernised legacy systems, retained specialist cyber staff, and reconfigured their cyber-insurance coverage.
For supervisors, the key takeaway is that targeted scrutiny can discipline operational risk-taking in domains where traditional tools are blunt — and that the CyRST’s design features (no capital consequences, no bank-level disclosure, intensive bilateral engagement) may serve as a reference model for extending stress-testing to cyber and other operational risks.
