London/Chicago/New York, 10 August 2021: U.S. banks are generally well positioned to handle average modelled cyber risk losses; however, tail events from a systemic cyber risk event can be material, according to a new Fitch report, “Quantifying U.S. Bank Systemic Cybersecurity Risk.”
The financial impact of a cyber event often centers around the reported remediation, or in the case of ransomware, the requested ransom payment. But, the financial cost from a cyber event is likely to extend well beyond just headline figures. Additional costs from these tail events can include data restoration, investigation and response, regulatory legal fines, and brand damage. Cyber risk insurance can mitigate some of these costs.
Fitch collaborated with CyberCube, a leading cybersecurity quantification company, to model the impact of systemic cyber events on the U.S. banking sector under various cyber risk scenarios. CyberCube’s model focuses on “single points of failure” (SPoF) for cyber incidents that could impact parts of the US banking system. SPoFs are technologies (e.g. operating systems, cloud service providers etc.) for which connectivity and dependencies are identified by bank. A cyber attack on a particular SPoF may have a cascading impact on the identified connected banks.
The infection of a SPoF is a force multiplier creating significantly larger footprints of compromise than in traditional attacks that infect one bank or system at a time. “Systemic cyber risks are as important to analyse as idiosyncratic cyber risks”, said Fitch Managing Director Christopher Wolfe. “Cyber risk is evolving into broader aggregations and concentrations within the vendor management and supply chain. An incident at a single critical third- or fourth-party vendor could lead to significant business interruption losses”, said Wolfe.
For the purpose of this research, Fitch and CyberCube analysed the entire U.S. banking sector of approximately 4,900 banks with over $1.1 trillion in total revenues. This portfolio went through CyberCube’s proprietary model to quantify the potential impact of cybersecurity incidents on the US banking industry over a one-year period.
“Our work with Fitch has identified the top threat scenarios for the U.S. banking, and the repercussions a cyber risk might have on an individual bank”, said Souki Chahid, CyberCube Principal Product Advisor. “A greater understanding of the inherent risks faced by the banking sector will support banks in their decision-making with regards to their insurance purchasing and their operational risk”.
This analysis complements Fitch’s initial report on “Exploring Bank Cybersecurity Risk,” published in April. That report evaluated individual bank vulnerability to a cybersecurity risk through the lens of cyber risk scores, whereas this analysis assesses the potential aggregate impact on the industry in the event of a cyber incident.
The report highlights five key findings from the analysis: a comparison of banks by size and their exposure to systemic cyber risks, an analysis of the average annual loss for the industry, a review of the five scenarios generating the largest modeled losses, performance of rated banks by modeled losses, and the difference in purchasing of cyber insurance at large versus small banks.
“Quantifying US Bank Cybersecurity Risk” is available at www.fitchratings.com. More information on CyberCube is available at www.cybcube.com.
