IMF's Tobias Adrian: The Window Between Discovering a Software Vulnerability and Exploiting It Is Shrinking

Tobias Adrian, financial counsellor and director of the Monetary and Capital Markets Department at the International Monetary Fund (IMF), told Bloomberg in an interview that the gap between the discovery of a software vulnerability and its exploitation by attackers is shrinking — and that this poses a real threat to financial stability.

What the IMF official said

Adrian made the remarks to Bloomberg's Francine Lacqua on The Pulse. The interview was recorded on the sidelines of the European Central Bank's Forum on Central Banking in Sintra, Portugal, one of the most important annual gatherings of the world's central bank leaders.

• Speaker — Tobias Adrian, financial counsellor and director of the IMF's Monetary and Capital Markets Department
• Key point — the "vulnerability → exploitation" cycle is getting shorter
• Venue — the ECB Forum on Central Banking in Sintra
• Format — Bloomberg TV interview, The Pulse with Francine Lacqua

"This creates a real threat to financial stability,"

Adrian said.

Why financial authorities are worried

The faster attackers can exploit a fresh vulnerability, the less time banks, exchanges, and payment systems have to deploy patches and secure their infrastructure. The financial sector carries trillions of dollars in transactions and depends on systems staying available around the clock. For that sector, even a short window between a vulnerability's disclosure and the first attack can lead to settlement failures, customer data leaks, or market manipulation.

That is why cybersecurity comes up regularly at meetings of regulators such as the IMF and the ECB, alongside traditional topics like inflation and interest rates. Regulators increasingly treat cyberattacks on infrastructure as a systemic risk — one capable of destabilizing the financial system as badly as a banking crisis.

Who needs to respond to faster attacks

Adrian's message is aimed not only at banks' IT teams but at regulators themselves. Infrastructure defenders could once count on days or weeks between a vulnerability's disclosure and the first mass attack. A shrinking window forces a rethink of patch management, threat-intelligence sharing between financial institutions, and how quickly updates roll out to critical systems — from exchanges to payment gateways.

The IMF has been including cyber threats in its global financial stability reports for several years now, alongside debt and currency risks. The Sintra forum, for its part, has traditionally served as a venue where central bank leaders align their positions on issues that go beyond conventional monetary policy.

The department Adrian leads is responsible for monitoring risks to global capital markets, and it regularly warns regulators about new threats to banking-system resilience, whether those are individual countries' debt problems or technological vulnerabilities. Placing cyberattacks alongside those warnings shows that the IMF no longer treats the topic as a niche concern for banks' IT departments. Instead, it now views it as part of macroprudential supervision — the set of measures regulators use to prevent crises that hit the financial system as a whole.

What it means

The IMF's warning signals that regulators no longer see cybersecurity as a narrow technical issue: how quickly software vulnerabilities get patched is becoming part of the overall picture of global financial system resilience.