Cyber risk stress testing for banks

What it contains

This FSI Brief from April 2026, written by Patrizia Baudino, explains that, given the growing frequency, sophistication and potential impact of cyber incidents, some authorities have disclosed that they run cyber stress tests to strengthen the resilience of firms and the sector to operational disruptions. A complete cyber risk testing programme should combine vulnerability assessments, scenario-based testing, penetration tests and red team tests. While penetration tests simulate attacks on live systems to find exploitable flaws, scenario-based stress tests assume that preventive measures have failed and focus on incident response and recovery.

The brief reviews three recent exercises, chosen for their relatively extensive disclosure and their comparability: those of the Bank of England, the Danish Financial Supervisory Authority (DFSA) and ECB Banking Supervision. From them it distinguishes two approaches, firm-focused or system-focused tests; the authority should choose the one that best reflects its institutional setup and the exercise’s objectives and keep it consistent across all its parts. It then presents the building blocks of a test and the choices the authority must make.

It acknowledges that these tests cannot fully replicate a real incident, but they give authorities and firms valuable insight into the effectiveness of their response and recovery processes and, in some cases, into the financial stability impact of such disruptions. It also notes that experience is still limited and that disclosure is very restricted so as not to expose participating firms to attacks; it concludes that improving and disclosing methodological aspects would help raise awareness and establish best practices.

Summary prepared by the Dominican Republic Risk Management Club from a reading of the original document, with the source verified on 12 October 2026. It does not replace reading the official text and is not advice.

See all publications