IMF Working Papers

Using Simulations for Cyber Stress Testing Exercises

By Tanai Khiaonarong, Kasperi N Korpinen, Emran Islam

May 2, 2025

Download PDF More Formats on IMF eLibrary Order a Print Copy
More formats on IMF eLibrary Order a Print Copy

Preview Citation

Format: Chicago

Tanai Khiaonarong, Kasperi N Korpinen, and Emran Islam. "Using Simulations for Cyber Stress Testing Exercises", IMF Working Papers 2025, 085 (2025), accessed May 4, 2025, https://doi.org/10.5089/9798229008952.001

Export Citation

  • ProCite
  • RefWorks
  • Reference Manager
  • BibTex
  • Zotero
  • EndNote

Disclaimer: IMF Working Papers describe research in progress by the author(s) and are published to elicit comments and to encourage debate. The views expressed in IMF Working Papers are those of the author(s) and do not necessarily represent the views of the IMF, its Executive Board, or IMF management.

Summary

We demonstrate how computer-based simulations could support cyber stress testing exercises through a three-step framework. First, cyber-attack scenarios are designed to target the systemic nodes of a payment network at different times, disrupting a major bank, critical service provider, large-value payment system, and a foreign exchange settlement system. Second, the stress resulting from the scenarios is simulated using transaction-level data, and its impact is measured through a range of risk metrics. And third, cyber preparedness is discussed to identify effective practices that could strengthen the cyber resilience of the financial sector. The exercise provides insights into the main vulnerabilities of the financial sector and key transmission channels under plausible scenarios that necessitate preemptive action and recovery and response measures. For example, simulation results for Finnish data suggest that end-of-day liquidity risk is most severe when a cyber-attack hits a major bank or several banks simultaneously through dependence on a common critical service provider, compared to an attack on a centralized payment system where effective queuing and liquidity-saving mechanisms can better support recovery. Outcomes could be aggravated under more severe and prolonged scenarios.

Subject: Asset and liability management, Cyber risk, Financial markets, Financial sector policy and analysis, Financial sector stability, Liquidity, Payment systems, Stress testing, Technology

Keywords: Cyber Resilience, Cyber risk, Financial sector stability, Liquidity, Payment systems, Simulation, Stress testing, Stress Testing

Publication Details

You May Also Be Interested In...

2025 Update of Resource Adequacy of the Poverty Reduction and Growth Trust, Resilience and Sustainability Trust, and Debt Relief Trusts

May 2, 2025

People’s Republic of China: Financial Sector Assessment Program-Financial System Stability Assessment-Press Release; Staff Report; and Statement by the Executive Director for the People’s Republic of China

April 30, 2025

Precautionary and Liquidity Line - Operational Guidance Note

April 30, 2025

FY 2026 Executive Board Work Program

April 29, 2025