Cybersecurity and geopolitical risks in financial markets

Annex D. Credit risk premium and stress analysis

Combining this stress-contingent pricing channel and propagation analysis, 47 illustrates how cyber incidents affecting the banking sector can amplify credit risk premia,1 particularly during periods of market stress. It describes the stress‑contingent pricing of cyber risk using a transparent regime‑split approach that is common in policy and academic work, where “stress” periods are defined using an upper‑tail cutoff of the VIX (e.g. the IMF’s Global Financial Stability Report (2024[102]) defines “stress” as periods when the VIX exceeds a high historical percentile). Splitting the sample further by the banking share of cyber incidents yields four regimes and reveals a clear non‑linearity: credit risk premia (high-yield option-adjusted spread; HY OAS) are elevated in stress periods overall, but they are highest when market stress coincides with bank‑heavy cyber activity – consistent with the amplification and contagion mechanisms discussed above.

This interpretation is consistent with a broader literature on financial amplification and network propagation. Studies of cyber risk in finance show that operational disruptions can affect intermediation and systemic stability (Chida, Kim and Yoshino, 2026[103]; Boungou, 2023[43]; Eisenbach, Kovner and Lee, 2022[4]). More broadly, production-network research shows that shocks to individual firms or sectors can propagate through supplier-customer linkages (Carvalho, 2014[12]), while cyber-specific evidence indicates that attacks can spill over from directly affected firms to their customers, with liquidity buffers and bank credit lines helping absorb the shock (Crosignani, Macchiavelli and Silva, 2023[10]). Taken together, this literature supports treating bank-heavy cyber incidents not only as operational events, but also as shocks that can tighten credit conditions, raise risk premia and interact with broader market stress.

In normal market conditions, the average high-yield option-adjusted spread remains broadly stable, with only a modest increase when cyber incidents are more concentrated in the banking sector. However, the pattern changes dramatically during market stress periods. When markets are already stressed, credit risk premia increase substantially; and when those stress conditions coincide with a high concentration of cyber incidents affecting banks, the spread increases to almost five times its normal-period level (from roughly 0.6 percentage points (p.p.) to over 3 p.p.).

This sharp escalation highlights an amplification mechanism: cyber shocks that disrupt key financial intermediaries become materially more consequential when they occur during fragile market states. Under such conditions, investors demand significantly higher compensation for risk, reinforcing a tightening in financial conditions and potentially exacerbating liquidity strains across the financial system.

Figure A D.1. Credit risk premium amplification due to banking cyber risks and during market stress periods among G7 countries

Note: Data are from the Advisen (Zywave) cyber incident database and OECD calculation. Banks are identified as entities classified under NAICS 522 (Credit Intermediation and Related Activities). Series are quarterly counts of recorded cyber incidents. The most recent quarters may be subject to reporting lags and should be interpreted with caution. Bars report the average of ICE BofA US High Yield Index Option-Adjusted Spread (BAMLH0A0HYM2) for each bucket. “Market stress” is defined as quarterly with VIXCLS at or above the 80th percentile of the sample. “Bank-heavy cyber months” are those where the banking share of cyber incidents (BankShare = Banks / Total) is at or above the 75th percentile among months with Total > 0. The pattern is descriptive and should not be interpreted as causal evidence.

Source: Advisen/Zywave Cyber Loss Insight feed; Federal Reserve Economic Data; OECD calculations.

Rather than suggesting causal identification, this simple regime‑split illustration demonstrates how cyber risk can interact with macro-financial stress in ways that magnify market responses. The result strengthens the case for incorporating stress-contingent cyber scenarios into supervisory monitoring and stress‑testing frameworks, particularly where disruptions to core financial institutions could amplify risk premia and propagate shocks across markets.

Note

← 1.  While risk premia are commonly decomposed into equity, liquidity, and credit components, the discussion here focusses on the credit‑risk channel, which is most relevant for the real‑economy transmission of cyber shocks. Credit premia are particularly sensitive to disruptions affecting SMEs and supply‑chain partners, as these firms typically operate with thinner cash buffers, weaker collateral positions, and higher baseline credit risk. Cyber incidents can therefore amplify borrowing costs or restrict credit access for smaller suppliers, generating spillovers along supply chains and magnifying macro‑financial vulnerabilities.