Quantitative modeling of cyber risks in Gulf banks and FinTech platforms

  • 15 Views
  • 2 Downloads

Creative Commons License DMCA.com Protection Status
This work is licensed under a Creative Commons Attribution 4.0 International License

Type of the article: Research Article

Abstract
FinTech growth in the Gulf has expanded digital access to banking services, but cyber-risk governance has not advanced at the same pace. This study develops and applies a quantitative framework to evaluate institutional, systemic, predictive, and probabilistic dimensions of cyber risk across Gulf financial technology ecosystems, including commercial banks, digital wallets, and payment platforms. The empirical design combined an application-level sample of ten leading mobile financial platforms with a vulnerability-level observation dataset generated through repeated static and dynamic security assessments between July 2024 and May 2025. The analysis integrated comparative statistical testing, extreme value modeling, dependency analysis, machine learning classification, and Bayesian estimation. The results revealed significant institutional divergence in vulnerability severities (p < 0.01), with Saudi Arabian Android banking applications recording the highest mean score (8.12) and UAE iOS applications the lowest (7.29). The risk distribution displayed a heavy-tailed structure, with a shape coefficient of 0.22 and a scale coefficient of 0.78, indicating that rare but severe vulnerabilities dominate exposure. Dependency modeling identified systemic linkages between platform type, regulatory environment, and vulnerability category, with correlations ranging from 0.29 to 0.36. Machine learning classification achieved 85% accuracy and 84% precision, while Bayesian estimation produced narrow 95% credibility intervals. The findings highlight distinct, quantifiable cyber-risk patterns across Gulf banks and FinTech platforms and support the need for integrated, data-driven supervisory frameworks.

view full abstract hide full abstract
    • Figure 1. QQ-plot illustrating the fit of the GPD to exceedances above CVSS 8.0
    • Table 1. Selected mobile financial applications (Dec 2025 – Mar 2026)
    • Table 2. Measurement of constructs and variables
    • Table 3. Grouped mean vulnerability severities by platform and country
    • Table 4. Posterior contrasts across platform-country groups
    • Table 5. EVT threshold sensitivity
    • Table 6. Copula-based dependency estimates
    • Table 7. Final copula selection by variable pair
    • Table 8. Machine learning classification performance
    • Table 9. Extended model performance
    • Table 10. Hierarchical posterior summaries of mean vulnerability severities
    • Table 11. Posterior probability comparisons
    • Table 12. Summary of hypotheses testing results
    • Conceptualization
      Zaid Mohammad AL Hawatmah, Ayman Bader
    • Data curation
      Zaid Mohammad AL Hawatmah
    • Formal Analysis
      Zaid Mohammad AL Hawatmah, Ayman Bader
    • Investigation
      Zaid Mohammad AL Hawatmah, Ayman Bader
    • Methodology
      Zaid Mohammad AL Hawatmah, Ayman Bader, Munif Zoubi
    • Project administration
      Zaid Mohammad AL Hawatmah
    • Resources
      Zaid Mohammad AL Hawatmah
    • Software
      Zaid Mohammad AL Hawatmah, Ayman Bader
    • Supervision
      Zaid Mohammad AL Hawatmah
    • Validation
      Zaid Mohammad AL Hawatmah, Ayman Bader
    • Visualization
      Zaid Mohammad AL Hawatmah, Ayman Bader
    • Writing – original draft
      Zaid Mohammad AL Hawatmah, Munif Zoubi
    • Writing – review & editing
      Ayman Bader
    • Funding acquisition
      Munif Zoubi