EU-maiden pankkien kyberturvallisuusraportointi - Korkiakoski, Juho (2025)
This study focuses on cybersecurity disclosure of publicly listed banks in EU countries as part of their annual reporting. Due to the transparency of their op-erations, listed entities are expected to communicate with their stakeholders about risks related to their activities and the associated risk management as part of their annual reports and annexes. Accordingly, companies also report on cybersecurity within these frameworks as part of their annual reports, but they must exercise discretion regarding the scope and depth of reporting due to the sensitive nature of the information. Cybersecurity disclosure is examined in the context of EU countries and banks because the financial sector, particularly banks, plays a significant role in the economy, societal stability, and security. At the same time, European pub-licly listed banks face considerable new regulations and attention related to cybersecurity. Cybersecurity risks have also emerged as the top concern for banks in Europe. The purpose of this study was to address the question, "How do EU banks report on their cybersecurity in their annual reports?" The study was conducted using qualitative methods, analyzing the 2023 annual reports of the largest European banks through theory-driven content analysis. The results of the study revealed significant differences in the extent of cybersecurity disclo-sure among the largest listed banks in EU countries. However, a common fea-ture of the banks that provided the most comprehensive reporting was their avoidance of personal disclosures, while still reflecting annual-specific consid-erations in their reporting. Banks primarily addressed cybersecurity risks, ac-tions aimed at mitigating those risks, and administrative measures. On the oth-er hand, they refrained from disclosing the consequences of specific cybersecu-rity incidents they had experienced.