Bank Run Threats Drive Overinvestment in Bank Cybersecurity: The Financial Stability Model by Anand, Duley, and Gai
In a model published in the Review of Finance, Anand, Duley, and Gai identify two opposing forces in cybersecurity investment: free-riding suppresses investment, while bank run risk incentivizes it. When rollover risk is sufficiently high, banks may invest more in cybersecurity than the socially optimal level. The model also distinguishes between the differing incentive directions under solvency-driven versus liquidity-driven failures.
Insufficient investment in bank cybersecurity is typically attributed to free-rider problems: one bank's protective investments benefit the entire financial network, but the costs are borne individually, leading to collective underinvestment driven by individual rationality. In their 2026 model published in the Review of Finance, Anand, Duley, and Gai identify another opposing force—the threat of bank runs itself can incentivize banks to increase cybersecurity investments.
The mechanism works as follows: a successful cyberattack could disrupt operations and shake creditor confidence, prompting depositors or financiers to withdraw funds or refuse to renew financing. Anticipating these consequences, banks have stronger motives to prevent attacks. The authors thus identify two opposing forces: free-riding discourages cybersecurity investment, while the threat of a run encourages it. When rollover risk is sufficiently high, the latter may outweigh the former, causing banks to invest more in cybersecurity than the socially optimal level.
The direction of this conclusion depends on the failure-driving mechanism. The model distinguishes two scenarios: when failure is driven by insolvency, bank and creditor actions reinforce each other—higher cybersecurity investment leads to a higher debt burden, which in turn strengthens protection incentives, creating a positive feedback loop; when failure is driven by illiquidity, additional cybersecurity investment instead lowers the debt burden, eliminating the bank's risk-return trade-off and dissipating the incentive effect. This implies that regulatory correction tools need to be designed separately for different margins (the protection margin or the resilience margin).