SEBI Chairman Tuhin Kanta Pandey has called for India’s financial sector to move from periodic compliance to a model of continuous, risk-driven cyber resilience, stating the question is not if an attack will occur, but how fast one can recover.
India’s financial sector needs to shift from periodic cybersecurity compliance to continuous, risk-driven cyber resilience as threats become increasingly interconnected and sophisticated, SEBI Chairman Tuhin Kanta Pandey said on Monday.
A Collaborative Approach to Cyber Defence
Speaking at SEBI’s Symposium on Cyber Defence, being held from August 17-21, 2026, in Mumbai, Pandey stressed that the key question for financial institutions is no longer whether a cyberattack will occur, but how quickly they can detect, contain, recover from and learn from an incident. The symposium brings together domestic participants and international delegates from 15 IOSCO jurisdictions, along with financial regulators, regulated entities, technology institutions and academia. It is designed to provide hands-on experience through classroom sessions, role play during tabletop exercises and real-time simulation experience using a Cyber Range platform. Pandey urged participants to use the exercises to identify weaknesses in their assumptions and preparedness under pressure.
“Cyber resilience that we see today is the outcome of efforts across a much wider ecosystem–regulators, financial institutions, academia, technology institutions, all contributing in different ways,” Pandey said, underscoring the need for greater collaboration across the financial ecosystem.
SEBI Launches New Cybersecurity Portals
At the inaugural ceremony, SEBI launched two portals aimed at strengthening information sharing and coordinated responses across the securities market ecosystem. The SEBI Incident Reporting Portal is intended to make cyber-incident reporting more structured, timely and actionable, while aligning with the CIFI format to facilitate greater uniformity and reduce friction in cross-border incident reporting. The Cyber Suraksha Portal will serve as a central hub for sharing cybersecurity knowledge, vulnerability warnings, policy measures and incident insights.
Adapting to Evolving Threats
Pandey also called for a fundamental rethink of vulnerability and patch management, arguing that periodic assessments are increasingly inadequate as vulnerabilities in software, cloud configurations, APIs and third-party dependencies evolve continuously. He advocated a cycle of continuous discovery, assessment, prioritisation, remediation and validation, supported by intelligent and increasingly automated patch management.
Post-Quantum Cryptography
He highlighted quantum computing as an emerging cybersecurity challenge and said post-quantum cryptography should move from a future research issue to a present-day migration programme. Financial institutions need to identify quantum-vulnerable systems, assess dependencies and build “crypto-agility” to transition between cryptographic algorithms without redesigning entire systems.
A Call for Collective Resilience
Pandey emphasised that cybersecurity is no longer merely an IT concern, but a board-level, business continuity, market integrity and investor confidence issue.
He concluded with three priorities,”Co-operate, Prepare, Respond”, calling for faster evolution of cyber defence through continuous learning, stronger capabilities and collective resilience. (ANI)
(Except for the headline, this story has not been edited by Asianet Newsable English staff and is published from a syndicated feed.)