Cybersecurity and financial stability

Abstract Cyber risk exposes banks to operational disruptions that can trigger runs. A bank chooses its cybersecurity by trading off protection against attacks with remaining resilient if an attack succeeds. Cybersecurity functions as a risk-management decision: it reduces the bank’s exposure to adverse outcomes but entails lower balance-sheet returns. Equilibrium cybersecurity depends on whether failure is driven by insolvency or illiquidity. When failure is insolvency-driven, bank and creditor actions reinforce one another: greater cybersecurity leads to a higher debt burden, which strengthens incentives for protection. When failure is illiquidity-driven, additional cybersecurity lowers the debt burden, eliminating the bank’s private risk–return trade-off. Socially optimal cybersecurity differs from the private choice, and corrective instruments must target either the protection or resilience margins. We extend the model to a system-wide environment in which cybersecurity is a public good, highlighting free-riding and the need for targeted regulation.