UBS Chief Elevates Cybersecurity to Core Bank Risk as External Review Finds Website Gaps

UBS CEO Sergio Ermotti says cyberattacks have become as important as, and in some cases more important than, traditional credit and market risks for banks. His warning places digital resilience alongside the financial controls that have long defined bank supervision and executive oversight.

The shift reflects how a successful attack can disrupt payments, expose client information, damage confidence and spread through shared financial infrastructure. Ermotti also urged regulators and the banking industry to stop stigmatizing institutions that suffer attacks, arguing that open reporting helps firms learn from incidents and strengthen defenses.

UBS describes cybersecurity as a priority for protecting client data, commercial information and financial assets. The bank says it uses a multilayered, risk-based approach focused on confidentiality, integrity and availability, supported by internal capabilities and external expertise.

Governance is built into that program. UBS says compliance and governance teams oversee and challenge protective measures, while regular internal and external assessments test the effectiveness of its controls. The bank frames the program around global industry standards and regulatory requirements, linking cybersecurity to operational resilience rather than treating it as a narrow technology function.

An UpGuard scan gave UBS an external security rating of 827 out of 950, or grade A, while identifying 7 failing checks among 71 tests. The assessment found no failures in email, network, IP and domain reputation, or vulnerability management, but it flagged issues in website security, encryption and related controls.

The listed findings include an unsafely implemented Content Security Policy, use of unsafe-eval in that policy and the absence of Certification Authority Authorization records. Those weaknesses can reduce protection against web-based attacks, including cross-site scripting. UpGuard stresses that its score covers externally observable systems and isn't an audit of UBS's internal controls, a distinction that matters when comparing a public rating with the bank's broader security program.

The combination of executive warnings and external testing points to a central problem for financial institutions: cyber risk spans both hidden internal systems and visible public infrastructure. A bank can maintain mature governance and still have internet-facing settings that require correction, while a clean external scan can't prove that internal defenses will withstand a sophisticated intrusion.

Ermotti's call for less stigma gives incident sharing a practical role. Banks that disclose attacks can help peers identify attack paths, improve sector defenses and give regulators a clearer view of systemic exposure. The approach also raises pressure for consistent reporting standards, because institutions, customers and markets need useful information without turning every disclosure into a punishment event.

Regulators are likely to keep treating cyber controls as part of core safety and soundness, alongside capital, liquidity and operational risk. The UBS discussion emphasizes executive accountability, while the UpGuard findings show why supervisory attention also reaches specific technical configurations on public websites.

Customers should read a security rating as one signal rather than a complete verdict. UBS's A grade and strong results across several external categories provide evidence of a substantial public security posture, but the 7 failed checks show that configuration work remains. For banks, the next test is whether governance, testing and transparent incident reporting produce fast remediation across both internal systems and customer-facing services.

UBS's message is that cyber defense belongs in the same risk conversation as lending losses and market volatility. Its published controls describe a layered program, while independent external monitoring shows a high rating with concrete web-security issues still open.

That combination makes remediation and disclosure the key measures to watch. The bank's public posture will be judged not only by its overall score, but by how it closes identified gaps, tests recovery and communicates incidents. Ermotti's broader argument reaches beyond UBS: financial institutions need controls that limit attacks and a culture that makes sharing lessons safer for the entire sector.