Investment in cybersecurity in an interconnected banking system has public-good proper- ties: positive externalities can generate systemic underinvestment. Using con?dential supervi- sory data from the European Central Bank, we ?rst identify “laggard” European banks that underinvest relative to their cyber-risk pro?les, and then examine how supervisory scrutiny af- fects their incentives to invest. We exploit the 2024 ECB Cyber Resilience Stress Test (CyRST) as a quasi-natural experiment. In a di?erence-in-di?erences design, we ?nd that following the CyRST announcement, laggard banks increased cybersecurity investment by about 80% rel- ative to their peers. The response is stronger among laggards subject to high-intensity su- pervisory oversight, consistent with scrutiny exerting a disciplining e?ect. Overall, the results suggest that targeted supervisory scrutiny may help mitigate underinvestment incentives and strengthen banks’ operational risk management.