MeitY Flags Asymmetric AI Cyber Threats in BFSI, Recommends Resilience Framework

The Ministry of Electronics and Information Technology (MeitY) has warned that AI is rapidly tilting the balance in favour of cyber attackers.

It has released the second edition of the Digital Threat Report 2025–26 for India's banking, financial services and insurance (BFSI) and payments ecosystem, drafted in collaboration with the Indian Computer Emergency Response Team (CERT-In), the Computer Security Incident Response Team in Finance (CSIRT-Fin), and cybersecurity firm SISA.

The report identifies AI asymmetry as one of the most significant risks facing financial institutions, noting that cyberattacks that once required specialist teams, significant resources, and weeks of effort can now be executed at machine speed by comparatively low-resource threat actors. 

As a result, offensive cyber capabilities are evolving faster than many defensive mechanisms and regulatory frameworks designed to contain them.

Drawing on extensive digital forensics and incident response (DFIR) research, CERT-In and CSIRT-Fin observations, and adversarial AI analysis, the report revealed that six of the seven forward-looking predictions made in last year's edition have already materialised. It concluded that the gap between the emergence of a cyber threat and its real-world exploitation has shrunk dramatically—from years to months or even weeks.

The report warned that threats once considered emerging—including social engineering, credential theft, supply-chain attacks, and cloud exploitation—have now become mainstream attack techniques. Increasingly, cyberattacks no longer resemble traditional intrusions but instead appear as legitimate user sessions, approved payments, manipulated workflows, or normal user behaviour, making them difficult to detect until significant damage has already occurred.

Addressing the launch, S Krishnan, Secretary, MeitY, emphasised the importance of public-private collaboration in strengthening India's cyber resilience.

"As cyber threats become increasingly sophisticated, trusted partnerships between public institutions and industry are essential to strengthening digital trust," Krishnan added.

Echoing this concern, Dharshan Shanthamurthy, Founder and CEO of SISA, said the shrinking timeline between technological innovation and cyber exploitation fundamentally changes how organisations must approach security. "The distance between innovation and exploitation has narrowed dramatically, and that single shift changes everything about how our industry must defend itself."

Highlighting the broader implications for the financial sector, he added, "The BFSI industry is built on trust—trust that a transaction is genuine, that the systems processing it are acting as intended, that money will move securely and irreversibly through a network of institutions that depend on one another. When that trust is weakened, the impact is never contained to a single breach or a single firm; it ripples across customers, partners, markets, and entire economies."

He further argued that cybersecurity must become a core business function rather than a purely technical responsibility. "Cybersecurity can no longer sit at the edge of the business as a technical control function. It has to become central to how institutions grow, innovate, and lead," Shanthamurthy mentioned.

The report also introduced a new analytical framework titled the "Anatomy of Cyber Failure", a 4-Layer Gap Archetype Framework that examines how modern cyber breaches unfold through a chain of compounding organisational and technical weaknesses rather than a single security lapse. According to the report, the framework is intended to help organisations identify recurring vulnerabilities, prioritise systemic risks, and direct investments toward the areas with the greatest security impact.

Sanjay Bahl, Director General, CERT-In, said India's increasingly interconnected financial ecosystem requires a more collaborative and continuous approach to cybersecurity. "As India's financial ecosystem becomes more interconnected, real-time and technology-driven, cyber resilience must be treated as a shared responsibility across institutions, regulators, and the wider digital supply chain."

He added that the report encourages organisations to move beyond periodic security assessments. "By translating emerging threat patterns into actionable guidance, it aims to help financial institutions anticipate systemic risks, strengthen operational resilience and protect trust in the country's digital financial infrastructure."

Beyond analysing current threats, the report outlined an 18-month roadmap for financial institutions, recommending a transition from strengthening foundational security controls to building continuous cyber resilience capabilities and more adaptive security architectures capable of responding to AI-driven threats.