Analysts warn banks that cybersecurity is a bigger bank risk than credit

JP Morgan has argued that cybersecurity now poses a greater threat to banks than credit risk, in a note that calls for US lenders to command a valuation premium.

The bank’s European equity research team described cybersecurity as one of the biggest risks not currently reflected in bank valuations.

It blamed limited disclosure, which it said leaves investors unable to compare how prepared individual banks are to handle threats supercharged by advanced AI and frontier models.

JPM questioned the heavy regulatory focus on capital ratios, arguing that viewing cyber risk through the capital framework is the wrong approach.

Instead, the broker called for greater attention to cybersecurity-driven liquidity risk.

It urged regulators to test banks with tougher infrastructure-resilience checks and a deposit-run liquidity haircut.

JPM said liquidity, rather than credit, could be the main trigger in any future banking crisis.

It pointed to social media as a likely accelerant of unprecedented swings in deposit flows, echoing the rapid outflows seen at Credit Suisse.

The note argued that this shifting environment will increasingly separate winners from losers.

Geopolitics is one dividing line, with US banks seen as advantaged through early access to the most sophisticated AI models, given the country sits at the epicentre of AI development, including initiatives such as Project Glasswing.

China was flagged as also being ahead of peers, leaving the rest of the world at a disadvantage.

Size is the other factor, with the largest systemically important banks expected to gain earlier access to new developments than smaller rivals.

JPM suggested investors should reconsider how they value lenders, assigning a higher multiple to banks with sticky client deposits and material excess deposits.

It said a premium for US global systemically important banks could be justified by their stronger ability to weather the next crisis.

US lenders trade on an average of 12.5 times forecast 2028 earnings, against 9 times for European banks and 12 times for Japanese megabanks.

JP Morgan said that gap could be warranted, reflecting better cyber preparedness through higher scalable technology spending and earlier access to the latest frontier models.