Disciplining digital risk: evidence from cyber stress tests
Investment in cybersecurity in an interconnected banking system has public-good proper- ties: positive externalities can generate systemic underinvestment. Using confidential supervi- sory data from the European Central Bank, we first identify “laggard” European banks that underinvest relative to their cyber-risk profiles, and then examine how supervisory scrutiny af- fects their incentives to invest. We exploit the 2024 ECB Cyber Resilience Stress Test (CyRST) as a quasi-natural experiment.