European central bank cyber tests forced underinvesting banks to spend 80% more on security

The European central bank's 2024 cyber stress test made banks that were underinvesting in security increase their spending. These "laggard" banks spent 80% more on cybersecurity after the test was announced, especially those under close supervision.

For years, regulators worried banks were not spending enough on cybersecurity, but it was hard to prove or enforce. This paper shows that targeted regulatory pressure works. It means central banks can now use stress tests to directly force specific banks to fix their digital weaknesses.