Cyber risk quantified
Aldasoro et al. use a database of more than 100,000 cyber events across sectors to document the characteristics of cyber incidents and quantify cyber risk. They find:
- The average cost of cyber events has increased over the last decade. These costs are higher for larger firms and more connected events;
- The financial sector experiences the highest number of cyber incidents, especially privacy and lost data incidents. However, banks and insurance companies incur more limited losses relative to other sectors, likely due to the effects of regulation and higher investment in cyber security;
- The use of cloud services is associated with lower costs, especially when cyber incidents are relatively small. But as cloud providers become systemically important, cloud dependence is likely to increase tail risks.
The drivers of cyber risk
Authors: Iñaki Aldasoro, Leonardo Gambacorta, Paolo Giudici, Thomas Leach
From: BIS, University of Pavia
From cyber risk to financial instability
In this paper Adelmann et al. highlight the transmission channels through which a cyber attack can lead to financial instability:
- Loss of confidence: Lengthy outages and compromised data integrity can lead to a loss of confidence. Such loss of confidence is likely to affect liquidity;
- Lack of Substitutability: Cyber attacks can lead to the loss of a key service and expose simultaneously many institutions to threats affecting the entire financial sector;
- Interconnectedness: Technology interconnectedness i.e. exposure to common hardware and software packages, as well as common technology service providers such as cloud services may exacerbate contagion risk from cyberattacks.
Cyber Risk and Financial Stability : It’s a Small World After All
Authors: Frank Adelmann, Jennifer A. Elliott, Ibrahim Ergen, Tamas Gaidosch, Nigel Jenkinson, Tanai Khiaonarong, Anastasiia Morozova, Nadine Schwarz ; Christopher Wilson
From: IMF
