Vulnerabilities Beyond CVEs: Cyber Resilience and the Next Financial Crisis

The talk argues that structural weaknesses, rather than individual flaws like CVEs, determine whether a disruption grows into a wider failure. Drawing on work studying financial stability, the speaker separates shocks, which are unpredictable events, from vulnerabilities, which are always present and can be measured and reduced. The framing borrows from medicine: chronic conditions such as high blood pressure raise susceptibility, while a newly disclosed bug resembles an infection that can be treated once known.

The core of the talk is four vulnerabilities: leverage, liquidity, linkages, and leadership. Each is traced through the 2008 crisis, including the mortgage-backed securities boom and Lehman Brothers' collapse, and then mapped onto IT operations. Examples include a technology provider to banks taken offline by malware, which measurably cut its customers' payment volumes and strained other banks, the Equifax breach linked to slow patching, the Colonial Pipeline ransomware incident, and the CrowdStrike outage and SolarWinds compromise as illustrations of how failures spread through supply chains.

To close, the speaker reviews post-2008 reforms such as stress tests, living wills, higher capital and liquidity buffers, and central clearing, and suggests comparable practices for cyber resilience: redundancy, cyber stress testing, shared responsibility with vendors, and third-party risk management. The takeaway is to ask whether an organization is managing these underlying weaknesses, not only patching known CVEs. The audience questions touched on small businesses and the pull of short-term incentives.