Financial Firms Spend Up to $3,000 Per Employee on Cybersecurity

Yalman Onaran, Bloomberg News

VALENCIA, SPAIN - JULY 18: A keyboard is seen during the DreamHack Valencia 2014 on July 18, 2014 in Valencia, Spain. Dreamhack Valencia is one of the European stops from the Dreamhack World Tour, the world's largest LAN party and computer festival. This year 3,000 devices will be connected to the Dreamhack Valencia network. (Photo by David Ramos/Getty Images) , Photographer: David Ramos/Getty Images Europe

(Bloomberg) -- Big banks and other financial firms spend as much as $3,000 per employee to defend computer networks from cyber criminals, a survey found, as the industry remains the primary target of such attacks.

That would translate to about $750 million annually for JPMorgan Chase & Co. and HSBC Holdings Plc each, based on their 2018 headcount figures. For Bank of America Corp. and Citigroup Inc. it would mean some $600 million each.

Some of the largest banks tripled cyber-defense budgets in the last three to four years amid a surge of attacks on client information, accounts and other data. The finance sector was the focus of 19 percent of all attacks monitored by International Business Machines Corp. last year, the technology firm said in a February report. Spending more on security doesn’t necessarily translate to better defenses, Deloitte said.

“Money alone is not the answer,” said Julie Bernard, a principal in Deloitte’s cyber-risk division. “How a security program is planned, executed and governed is as important, if not more.”

The survey was conducted by Deloitte and the Financial Services Information Sharing and Analysis Center from October to November. The average cybersecurity outlay was $2,300 per worker for the 96 financial firms that took part.

To contact the reporter on this story: Yalman Onaran in New York at yonaran@bloomberg.net

To contact the editors responsible for this story: Michael J. Moore at mmoore55@bloomberg.net, Dan Reichl, Daniel Taub