Cyber Risk Conference: Putting Metrics Into Action
As cyber threats and technologies evolve, organizations must update their metrics, risk management approaches and incident response strategies. This was a key theme of the 2025 Cyber Risk in the Financial Sector Conference co-hosted by the Federal Reserve Bank of Richmond, the Federal Reserve Board of Governors, and the Massachusetts Institute of Technology’s Internet Policy Research Initiative in October. This year’s focus, “Putting Cyber Metrics into Action,” brought together experts from industry, government and academia to discuss the growing threat of cyber risk in the financial sector.
Conference Highlights
Panelists at the conference emphasized the need for cyber risk management practices to continuously adapt and evolve in the face of ever-growing risks. There was a consensus that basic cyber hygiene procedures remain critical, and failure to implement them accounts for a significant proportion of cyber risk exposure. The need to move from siloed, business-line specific risk management and to facilitate better communication between cybersecurity practitioners and boards of directors was also highlighted.
Another key discussion point was the need to better harmonize industry-wide risk management standards that align with regulatory requirements across jurisdictions. Speakers noted the challenges of navigating different global standards and frameworks across the U.S. and European Union. Inconsistency among incident reporting requirements was identified as a hindrance to effective information sharing and coordination.
The conference also delved into the impact of technological advancements on the cyber risk landscape, focusing on artificial intelligence (AI) and quantum computing. Participants discussed how firms and malicious actors leverage AI to automate offensive and defensive cyber activities and agreed that AI could increase the speed of vulnerability exploitation and exacerbate risks from existing attack vectors, particularly social engineering. On the flip side, there was optimism that cybersecurity professionals, also equipped with AI tools, could identify, patch and mitigate incidents more efficiently. Conference participants emphasized the importance of a “human-in-the-loop” approach to responsible AI deployment.
