Cyber Risk, Market Failures, and Financial Stability

Abstract

Cyber-attacks on financial institutions and financial market infrastructures are becomingmore common and more sophisticated. Risk awareness has been increasing, firms activelymanage cyber risk and invest in cybersecurity, and to some extent transfer and pool theirrisks through cyber liability insurance policies. This paper considers the properties of cyberrisk, discusses why the private market can fail to provide the socially optimal level ofcybersecurity, and explore how systemic cyber risk interacts with other financial stabilityrisks. Furthermore, this study examines the current regulatory frameworks and supervisoryapproaches, and identifies information asymmetries and other inefficiencies that hamper thedetection and management of systemic cyber risk. The paper concludes discussing policymeasures that can increase the resilience of the financial system to systemic cyber risk.

Keywords: Systemic risk, Public goods, Cyber risk, cyber insurance, cyber regulation, risk management, information asymmetries, market failure, General, Externalities, Asymmetric and Private Information, General, General

JEL Classification: D50, D62, D82, G20, H41