Banks globally continue to increase investment in cybersecurity and bolster their defences against evolving digital threats, according to Moody's Ratings's survey of 228 banks worldwide.

This is credit positive because banks, which manage vast amounts of customer and proprietary data, safeguard customers' wealth, and enable transactions across payment networks, serve as critical infrastructure and are prime targets of cyberattacks.

Banks' leadership is increasingly focusing on cyber governance. An emphasis on cyber governance, evidenced by the presence of chief information security officers (CISOs) and cyber managers' active engagement with leadership teams and board members, highlights a commitment to embedding cybersecurity into strategic decision-making.

Spending for cybersecurity is growing across regions. Our survey shows a growing share of banks globally allocate more than 10% of their technology budgets to cybersecurity. About half of our survey respondents globally plan to increase cybersecurity staff in the next year. These results show a global push to strengthen cyber defence measures.

The adoption of advanced cyber defence strategies is more widespread among banks than average for all sectors. Among the key types of advanced defence measures, almost all of our survey respondents have adopted penetration tests. In addition, tabletop simulations and red/purple team engagements are prevalent among large banks in North America, and Europe, the Middle East and Africa (EMEA).

Banks are gradually increasing their use of public cloud for IT infrastructure. Cloud adoption is effective in mitigating cyber risks, offering superior disaster recovery and data preservation capabilities, and enhancing security resilience.

Standalone cyber insurance is becoming standard practice among banks in North America and EMEA, as well as those with high ratings. All of our survey respondents in North America and 81% of those in EMEA have purchased standalone cyber insurance policies, up from 91% and 69% in 2021, respectively.

Artificial intelligence (AI) governance is advancing among large and highly rated banks. While banks are investing heavily in cybersecurity, the rapid pace of technological changes pose risks as current defences could quickly become obsolete.

Banks' leadership is increasingly focusing on cybersecurity governance

Moody's Ratings's survey shows that banks are increasingly integrating cybersecurity into core management and governance frameworks. As cyber threats evolve, the maturity of executive engagement will be crucial for institutional resilience and the effectiveness of risk management.

Over the years, cybersecurity has emerged as a critical management priority for banks due to the need to protect sensitive data, comply with stringent regulations, counter sophisticated cyber threats, manage vulnerabilities arising from technological advancements, maintain systemic interconnectedness and uphold trust and reputation.

While the number of cyberattacks on banks and other financial companies has fallen after a resurgence in 2023, losses from such incidents are significant and could lead to a greater impact on credit worthiness.

Including a CISO on the executive team is crucial for embedding cybersecurity into strategic decision-making and ensuring accountability to reflect a commitment to a comprehensive, enterprise-wide approach. A tighter reporting structure enhances awareness and understanding of cyber risks by garnering stronger support from the executive team for organisation-wide risk management strategies. Consequently, appointing a CISO has become a standard practice among banks.

Survey data indicates that the proportion of banks appointing CISOs has steadily increased across all regions, reaching 71% in 2025, compared to 68% two years earlier. This trend suggests greater visibility for cybersecurity at the top levels of banks. In North America, 97% of banks have adopted the CISO title by 2025, while 75% of banks in Europe and 58% in each of Latin America and Asia have opted for alternative titles for cybersecurity leadership roles. In Asia, 37% of cybersecurity leaders report directly to CEOs or CFOs, a significantly larger proportion than in other regions.

As the management of cyber risks becomes an enterprise-wide strategic matter, many banks have established frameworks for regular interactions between cybersecurity leaders and executive management, including board members, to ensure timely and informed decision-making through clear communication of risk status and response strategies. Globally, such reporting structures have gained traction. At 19% of banks globally in our survey, senior cybersecurity managers report directly to CEOs or CFOs, up from 15% in 2023, reflecting a narrowing gap between cybersecurity functions and executive oversight. Nevertheless, this also shows banks in general have some way to go in achieving effective executive oversight.

A CEO compensation package that includes an incentive for achieving defined cyber risk objectives indicates that an enterprise holds its executive team accountable for managing those risks. Among banks that participated in our survey, 40% in aggregate include cyber risk objectives in their CEOs' compensation packages, compared to 21% for all sectors, which we believe is because of high sensitivity and value of financial data, strict regulatory requirements and the significant impact of cyber threats on trust and reputation.

A greater share of our survey participants link cybersecurity to CEO compensation in Asia-Pacific than in other regions, which likely reflects strategic priorities for digital transformation and regulatory pressure. Banks in Asia-Pacific, particularly those in Singapore, Australia, and Malaysia, are actively pursuing digital transformation. Further, many regulators in the region, such as the Monetary Authority of Singapore, impose stringent guidelines for technology risk management that require rapid incident reporting and robust cyber governance.

Moody's Ratings's survey also shows that at most banks globally, senior cyber risk managers report cybersecurity-related matters to their C-suite or boards at least quarterly, which indicates that regular sharing of information on cybersecurity with senior leadership is becoming a standard practice.

Frequent reporting helps demonstrate transparency and a commitment to risk management, which can mitigate reputational and regulatory concerns. Cybersecurity reporting tends to be more frequent at smaller banks, and hence, at those in Asia Pacific and Latin America. Asia Pacific and Latin American banks often have simpler organisational structures because there are more small banks in those regions than in North America and Europe, where banks typically are larger and need to deal with a broader range of issues. Also, board members at banks in North America often have prior cybersecurity leadership experience, which – along with a regulatory emphasis on testing, instead of reporting – reduces the need for frequent updates from managers.

The size of an organisation also influences its governance structure. Among large banks that participated in our survey, 52% have dedicated cybersecurity committees, compared to 31% for small banks.

Information sharing with regulators, which can help understand common weaknesses, is an area that has room for improvement. For one, reporting of cyber incidents to regulators remains incomplete, hindering effective monitoring of cybersecurity, the International Monetary Fund (IMF) said in its annual Global Financial Stability report for 2024. Also, our 2023 survey showed that banks do not report incidents to regulators consistently. This suggests the need for harmonised definitions and reporting standards. To address this, some regulators have introduced measures, such as the Digital Operational Resilience Act (DORA) in the EU and a 36-hour notification rule in the US.

These regulations will improve the accountability of banks for their cybersecurity practices, driving them to enhance their measures to protect critical information, although disparities remain across regions and institutions of different sizes. Smaller or lower-rated institutions, face resource constraints, which makes them more vulnerable to evolving cyber threats.

Spending for cybersecurity is growing across regions

Investment in cybersecurity measures is becoming a growing priority for banks globally as threats evolve.

Moody's Ratings's survey shows that banks in all regions are increasingly allocating more than 10% of their technology budgets to cybersecurity. This reflects heightened awareness of escalating cyber threats and a global imperative to strengthen digital defences. Notably, banks in Asia-Pacific and North America have increased allocations of their budgets to cybersecurity more steeply than their peers in Europe and Latin America in response to a rapid evolution of both digital infrastructure and cyberattacks.

In tandem with increases in cybersecurity budgets, more than half of our survey respondents plan to expand their cybersecurity personnel within a year. This trend underscores the urgent need for specialised talent to manage complex and shifting cyber risks and respond to incidents with agility and precision. Our survey shows that banks are focusing not only on growing headcount for cybersecurity but also on enhancing institutional expertise, which is crucial for developing resilient and adaptive cyber defence capabilities.

North America has the largest share of survey participants that outsource cybersecurity functions and provide related employee training at least every quarter. In-house cybersecurity risk teams offers several advantages, including reduced third-party access to corporate networks, tighter control over cyber risk management and the development of long-term proprietary expertise.Importantly, organisations can keep key control measures in-house. By contrast, outsourcing enables access to specialised skills that may not be available internally and provides the flexibility to scale cybersecurity operations without investment in permanent hires. The ongoing shortage of cybersecurity talent further reinforces the appeal of outsourcing.

APAC banks tend to emphasise internal development, on the back of increasing budgets and an evolving regulatory framework that encourages the in-house development of specialised knowledge. Our survey shows that banks in the Europe rely more heavily on outsourcing than in Asia Pacific, though less than in North America, likely due to strict data protection laws.

Increasing awareness of cyber threats and changing regulations have led banks globally to broaden the adoption of cyber defence measures. While implementation rates are generally high, they differ by regions and the size of each bank, possibly because of variations in operational maturity, resource availability and strategic priorities. Our survey shows North American and large banks consistently integrate more comprehensive cybersecurity measures. By contrast, such efforts are uneven at small and medium-sized banks, as well as banks in Asia-Pacific and Latin America, which we believe is because of legacy infrastructure and cost constraints.

Banks are generally quite advanced in perimeter protection, but a substantial proportion of our survey participants refrain from backing up data on completely isolated internal computer networks, or air-gapped networks, the use of which makes recovery from a ransomware attack difficult.

Key basic cyber defence practices include:

Incident response plans (IRP) are documented protocols designed to respond to cyber incidents with the goals of minimising damage, ensuring quick recovery and preventing recurrence. Among our survey respondents, 97% across all regions update their IRPs at least once a year.

Vulnerability management programmes identify and remediate security weaknesses in systems and applications. Nearly all our survey respondents have adopted such tools, showing that proactive threat mitigation is a now standard practice for banks across all regions, regardless of their sizes.

Data and system backups are crucial for ensuring data recovery and business continuity in the event of ransomware attacks or system failures. In our survey, 92% of large banks and 88% of banks in Asia Pacific and North America perform weekly backups, while 71% in Latin America do so.

Identity management services facilitate the management of user authentication and access across various systems. The share of survey respondents using such applications is the largest in North America and the smallest in Asia Pacific. About 74% of small banks use identity management services, a relatively low adoption rate that we believe reflects challenges related to costs and integration.

Multi-factor authentication (MFA) requires users to verify identity using two or more credentials to reduced the risk of unauthorised access. About 70% of our survey participants have adopted such measures. This suggests that while banks are widely aware of the importance of digital identity protection, full adoption of MFA remains a work in progress, possibly due to legacy systems or integration challenges.

Privileged access management (PAM) restricts and monitors the access of users with greater privileges to prevent misuse. Our survey shows that adoption of PAM is the most common in North America and among large banks, which suggests that they have a mature approach to mitigating insider threats. Banks in Latin America are behind, with 84% of survey respondents having implemented PAM measures.

The adoption of advanced cyber defence strategies is more widespread among banks than average for all sectors

Moody's Ratings's survey shows banks overall have implemented advanced cyber defence measures more widely than the average level for all sectors, a positive development.

Yet the degree of the adoption of advanced cybersecurity practices varies by region and the size of each organisation, reflecting differences in a bank's maturity, the availability of its resources and its strategic priorities. Banks in North America and large banks tend to have implemented advanced cybersecurity measures more widely.

The three key advanced defence practices are:

• Penetration tests simulate real-world attacks to identify exploitable vulnerabilities in systems and applications. These tests are the most widely adopted among the three advanced defence practices, with 55% of our survey respondents performing them at least quarterly.
• Tabletop simulations are structured, discussion-based exercises designed to guide teams through hypothetical cyberattack scenarios to test their response coordination. Our survey shows that the adoption rate is the highest in North America, at 46%, followed by 42% for large banks. By comparison, only 14% of our survey respondents in EMEA and 10% in Latin America have implemented this practice. This highlights differences in operational maturity and resource availability.
• Red/purple team engagements involve adversarial simulations that test both offensive and defensive capabilities in real time. Our survey shows that the adoption rate is high among large banks, at 64%, and among banks in North America, at 44%, but it drops to less than 20% for both small and medium-sized banks, likely due to the complexity, costs and expertise required for these exercises.

Regulatory bodies such as the Federal Financial Institutions Examination Council (FFIEC) in the US actively encourage these measures and incorporate them into supervisory evaluations to improve banks' technical preparedness and their organisation-wide crisis response capabilities.

The adoption of tabletop simulations and red/purple team engagements is less common than penetration tests because they are more complex. Those two measures require specialised expertise, coordination across teams and a proactive security culture — factors more commonly found at North American and large banks.

As banks increasingly rely on third-party vendors and software providers to support their operations, managing associated cyber risks has become a critical component of enterprise security. Increased cybersecurity breaches stem from the fact that supply chain vulnerabilities can affect banking systems and customer data integrity.

Moody's Ratings's survey shows that the adoption rate for programmes to manage third-party cyber risks is generally high among banks globally, with those in North America and large institutions leading nearly all categories, reflecting mature governance and regulatory pressure. Such measures are the least common for banks in Latin America and small banks. Notably, Brazil’s central bank has introduced rules to limit digital cash transfers via payment institutions, primarily financial technology companies, and imposed additional requirements on new market entrants that rely on third-party technology vendors.

Among those measures, 92% of our survey respondents in North America require their vendors to carry cyber insurance, far higher than 18% to 28% in the other regions, likely due to differences in the degrees of regulatory pressure and the maturity of cyber insurance. This also suggests that North America recognises the value of an additional layer of financial protection in the event of cyber incidents, such practices have yet to gain traction in other regions. US regulators, such as the Federal Deposit Insurance Corporation (FDIC) and FFIEC, emphasise the management of third-party risks and often require banks to include cyber insurance as part of their vendor oversight. Small banks may encounter resource constraints that limit the depth of their insurance programmes.

The need to mitigate financial losses also drives demand for cyber insurance policies, with a bank’s level of preparedness and resilience against cyber threats potentially influencing premium rates and coverage terms.

Banks are gradually increasing their use of public cloud for IT infrastructure

Moody's Ratings's survey shows that banks globally are progressively migrating their IT infrastructure to the public cloud, which can help improve flexibility, scalability and efficiency, although many are in early stages of this shift. Cloud adoption is effective in mitigating cyber risks, offering superior disaster recovery and data preservation capabilities, and enhancing security resilience.

Across all regions, more banks plan to host significant parts of IT infrastructure on the public cloud in the next year than now, according to our survey. Particularly, the use of the public cloud will increase faster among small and medium-sized banks than among large institutions. Many large banks have already implemented cloud applications. As such, they are likely focusing on optimising or consolidating their infrastructure internally as they often have highly complex legacy systems that are difficult to migrate.

The financial industry is undergoing rapid digital transformation, driven by the need to enhance customer experience, improve operational efficiency and strengthen risk management. The trend includes the adoption of generative AI and blockchain, which are reshaping financial services, pushing incumbent banks to rebuild their competitiveness.

The use of the public cloud also brings unique challenges to banks. In particular, because public cloud connections in advanced economies are concentrated among three major providers, a significant cyber incident affecting one of these providers could lead to a systemwide outage.

Standalone cyber insurance is becoming standard practice among banks in North America and EMEA, as well as those with high ratings

As cyberattacks become more frequent and sophisticated, banks – particularly those in North America and EMEA, as well as those with high ratings – are increasingly using insurance to mitigate their financial consequences. Cyber insurance is crucial for maintaining financial stability for banks by covering losses from system failures, data breaches and operational disruptions.

Moody's Ratings's survey shows that standalone cyber insurance is widely adopted in developed economies. All of our survey respondents in North America and 81% of those in EMEA have standalone cyber insurance policies, up from 91% and 69% in 2021, respectively. Particularly, coverage for system failures is common in those regions, where banks typically have more advanced risk management frameworks. A little more than half of our survey respondents in Asia Pacific have cyber insurance, but we expect the use of such protection in this region to grow further given increases in cybersecurity budgets and enhanced governance in the former.

The use of insurance is also prevalent among highly rated banks. They tend to be larger and generally better equipped to assess exposure to cyber risks and integrate insurance into broader strategies to build resilience. By contrast, lowly rated or small banks often struggle to adopt comprehensive cyber insurance due to barriers such as high costs and limited awareness.

AI governance is advancing among large and highly rated banks

Moody's Ratings's survey shows that large banks and those with high credit ratings have proactively established formal AI governance frameworks.

They have developed policies and operational guidelines to manage AI-related risks, emphasising transparency and accountability in the adoption of the technology. While banks are investing heavily in cybersecurity, the rapid pace of technological changes poses risks as current defences could quickly become obsolete.

About 94% of large banks in our survey have formal AI usage policies and 91% have deployed internal generative AI tools. By contrast, such practices are significantly less common among small banks and those rated Ba and below. 85% of banks rated A have AI usage policies and 85% have internal generative AI tools.

These results show that large and highly rated institutions are progressing swiftly in AI governance, whereas smaller and lower-rated banks are facing challenges, likely stemming from limited technical and human resources. Bridging this gap will require industrywide support mechanisms and knowledge sharing, both of which are crucial for ensuring responsible AI adoption across the global banking sector.

By region, banks in North America are the most advanced in formalising AI policies. More than 90% of our survey respondents in the region have established clear guidelines for AI tool usage, imposed strict restrictions on using internal data with public AI platforms and deployed internal-use generative AI systems.

By contrast, such practices are not as widespread in Asia-Pacific and Latin America. Particularly, only about 54% of our survey respondents in Asia-Pacific and 59% in Latin America have deployed internal tools.

In parallel with governance efforts, the adoption of generative AI tools is rapidly increasing across the banking sector. Many banks have implemented internal generative AI applications to streamline operations and enhance data analytics capabilities, especially those with greater scale and technical resources.

Banks utilise AI for tasks such as natural language processing, automated reporting, and optimising customer service. Given the growing use of AI, banks are more likely to follow formal security frameworks such as the OWASP Top 103. The majority of banks in North America follow the standards as they are generally large, and hence are more likely to adopt them.

Moody's Ratings report re-disseminated by The Asian Banker