Staff Reports
Systemic Cyber Risk
Number 1186
February 2026

JEL classification: G21, G23, G28, G29, O33

Authors: Steven D. Baker and Michael Junho Lee

We propose a quantitative framework to track systemic risk arising from cyber vulnerabilities of the U.S. financial system. Synthesizing financial, economic, cyber, and network data that covers thousands of financial institutions and technological firms, we develop an index that tracks financial-system-level cyber vulnerability (SCV) for the financial system. Geopolitical risk, ransomware and malware incidents, and seasonal factors significantly drive the estimated adversarial component. Estimated technological and financial components exhibit fat tails in the distribution. In the cross-section, SCV is attributable to a small set of the largest firms. Large technology firms, including Microsoft, Google, Cisco, and Apple, emerge as key contributors to SCV. These providers also represent the largest cumulative count of vulnerabilities, pointing to financial stability considerations arising from the common exposure to client firms. SCV for service providers co-varies with that of financial institutions, which could amplify financial stability risks. The framework puts forth an approach to include a broad set of entities into an aggregate assessment of cyber vulnerability.

Full Article
Author Disclosure Statement(s)
Steven D. Baker
I have nothing to disclose.

Michael Junho Lee
I have nothing to disclose.
Suggested Citation:
Baker, Steven D., and Michael Junho Lee. 2026. “Systemic Cyber Risk.” Federal Reserve Bank of New York Staff Reports, no. 1186, February. https://doi.org/10.59576/sr.1186

By continuing to use our site, you agree to our Terms of Use and Privacy Statement. You can learn more about how we use cookies by reviewing our Privacy Statement.   Close