Indian regulators are stepping up the vigil on cybersecurity, with the Reserve Bank of India (RBI) and the Securities and Exchange Board of India (SEBI) both reiterating their focus on protecting critical parts of the financial ecosystem from rising cyber threats amid the advent of AI.SEBI, for example, on Monday introduced an IT Resilience Index (ITRI) for market infrastructure institutions — entities such as clearing corporations and exchanges that enable trading in financial markets. “Any disruption, degrading in performance or compromise of these (IT) systems may adversely impact critical market operations and pose risks to the trust in the securities market,” the market regulator noted in its circular. The RBI released a new comprehensive cybersecurity framework late last month for banks and financial institutions and has also flagged the possibility of a “kill switch”. Both regulators have indicated increased attention towards cyber-related matters as AI makes fraud easier and more prevalent. This ranges from incidents like fraudsters using deepfake voices to bypass KYC norms, or more complicated scams that infiltrate the walls of critical financial services institutions. In fact, we’ve already seen cybersecurity threats infiltrating a few banks so far in 2026.Regulators increase cyber vigilanceSEBI’s ITRI for market infrastructure institutions (MIIs), for instance, quantifies cyber readiness and turns it into something tangible. The index has nine parameters — availability and security have a weightage of 20%, integrity, governance, reliability and monitoring, modularity and flexibility, and business continuity have a weightage of 10% each, while scalability and an “others” parameter with miscellaneous requirements have a weightage of 5% each.“SEBI’s IT Resilience Index is significant in that respect because resilience becomes something that can be measured, benchmarked and ultimately brought into boardroom accountability,” said Himanshu Bagai, partner at Saikrishna & Associates.The framework, which will come into effect from early 2027, will also include an “early warning system” and continuous monitoring to flag risks early. “MIIs shall compute ITRI on a half-yearly basis within a period of 60 days from the end of each half-year and submit the comparative analysis of two consecutive half-years (on a rolling basis) and corrective action,” SEBI’s circular said.Story continues below this adAlso Read | AI agents can do your tasks: Should you let them?The regulator on Monday also said it has aligned its cyber incident reporting portal for regulated entities with a standardized “Format for Incident Reporting Exchange” or FIRE format. This “will facilitate reporting of incidents in stages to reflect incident life cycle from initial reporting to intermediate updates and final closure, while acknowledging that certain information may not be available at the time of initial reporting,” the regulator said.SEBI said last week that it will be “shortly” issuing guidelines for responsible use of AI and machine learning in the market. In fact, while the regulator already has AI models monitoring to flag suspicious trading patterns, whole-time member Kamlesh Chandra Varshney indicated last week that SEBI has also developed a team to work on AI models covering corporate investigations.“Now a team has already been constituted. Like we have a system for trading data, can we have a system for quarterly results that are filed?” said Varshney at an event in Mumbai.SEBI now flags risks related to AI and the need to improve surveillance at almost all public forums, signifying the scale of the challenge lying ahead as technology keeps on changing.Story continues below this adAlso Read | After incidents involving AI agents, are companies facing a new kind of cybersecurity threat?The RBI has also taken a host of measures to both improve cyber surveillance and address the grievances of fraud victims. For example, both the RBI and SEBI are considering a “kill switch” mechanism — allowing users to stop all financial transactions from their accounts during fraud in the RBI’s case, while SEBI is evaluating a similar mechanism as part of its AI guidelines.The central bank also released a new comprehensive cybersecurity framework late last month for banks and financial institutions. The framework mandates board-level ownership of cyber risks, dedicated committees within organisations to monitor IT risks, and a strict six-hour window to report cyber incidents.It also revised its fraud compensation mechanism in June for consumers who have been victims of fraud, increasing the scope of victims who can now claim compensation, and included newer-age digital scams in its definition.What lies aheadWhile regulators have stepped up their interest in modernising cyber regulations, a lot of challenges remain. And regulators have to remain nimble as threats evolve with rapidly changing technology.Story continues below this ad“The challenge is that AI materially changes the threat equation. Traditional cybersecurity frameworks were largely designed around identifiable vulnerabilities, human-led attacks, and periodic assessments. AI can dramatically increase the speed, scale, and sophistication of attacks—from automated vulnerability discovery and highly personalised phishing to deepfakes, identity fraud, and increasingly autonomous cyberattacks,” explained Bagai of Saikrishna & Associates.Also Read | Why AI companies are cutting up books to train AI modelsRegulators should thus focus on AI-specific threat modeling, continuous rather than periodic testing, third-party and cloud concentration risks, model and data integrity, deepfake-enabled fraud, supply-chain vulnerabilities, and clear human accountability where AI systems influence critical decisions, said Bagai. “Regulators should also examine whether institutions can detect and contain machine-speed attacks in real time, including through AI-enabled defensive systems,” he added.“Surveillance architecture must be capable of addressing AI-enabled fraud and market abuse occurring at machine speed, including synthetic identities and coordinated algorithmic conduct. The preferable regulatory response is not an excessively prescriptive code which technology will rapidly overtake, but technology-neutral accountability supported by technology-specific safeguards,” according to Tushar Kumar, an advocate practicing in the Supreme Court of India.Regulators need to thus keep modernising their cyber frameworks and making them comprehensive. But they also need to be agile enough to match the pace of ever-changing technology.