#23: Cyber Resilience: Insights from Stress Testing

2 Sept

4th September 2025

With:

| Tanai Khiaonarong (IMF)

| Kasperi Korpinen (Bank of Finland)

| Emran Islam (IMF)

In Session #23, Tanai Khiaonarong (IMF), Emran Islam (IMF), and Kasperi Korpinen (Bank of Finland) join FNA to discuss their pioneering framework for Cyber Stress Testing. Drawing from their influential IMF working paper, our guests argue that because cyber-attacks are "active" threats—designed to exploit specific vulnerabilities—they require a different analytical lens than traditional credit or liquidity shocks.

The discussion focuses on the use of computer-based simulations to model the cascading effects of a cyber incident. By simulating a "total outage" or a "data integrity compromise" at a systemically important bank or an RTGS (Real-Time Gross Settlement) system, central banks can quantify how quickly a cyber-induced liquidity freeze would spread across the entire financial network.

Key Discussion Points:

The Simulation Mandate: Why simulations are uniquely capable of capturing the "non-linear" risks and contagion effects of cyber-attacks compared to static stress tests.
The IMF Framework: A step-by-step guide to identifying systemic nodes, mapping dependencies, and simulating realistic cyber-adversary behavior.
Liquidity Contagion: Analyzing the "Liquidity Sink" effect—how a cyber-attack on one participant can trap funds and prevent the rest of the network from settling obligations.
Data Integrity vs. Availability: Discussing the "silent threat" of corrupted transaction data and why it is often more dangerous than a simple system outage.
Operational Resilience: Lessons from the Bank of Finland on integrating simulation results into national contingency planning and crisis management.
Policy & Oversight: How regulators can use these simulation insights to set more accurate "Maximum Tolerable Downtime" (MTD) targets for critical infrastructure.

Watch on Demand:

Listen on: Spotify | Apple | Amazon Music