SEBI Establishes Task Force to Combat AI-Driven Cyber Threats

SEBI Issues Advisory on Cybersecurity Risks Arising from AI Tools

The Securities and Exchange Board of India (SEBI) has issued a circular advising regulated financial entities about emerging cybersecurity risks associated with advanced artificial intelligence tools used for vulnerability detection. These tools, similar to "Mythos," are increasingly being adopted across the financial ecosystem to identify system weaknesses at high speed and scale.

Growing Use of AI-Driven Tools Introduces New Risks

While AI-driven tools improve the ability to detect security gaps, SEBI has cautioned that they also introduce new risks related to data confidentiality, system integrity, and the reliability of outputs generated by such models. The regulator noted that the growing use of automated tools could potentially increase exposure to cyber threats and enable faster exploitation of vulnerabilities if not properly controlled.

Read also: Treasury Yields Experience Largest Increase in Two Weeks Following Release of Labor Market Data

Constituted Task Force to Address Cybersecurity Concerns

To address these concerns, SEBI has constituted a dedicated task force named cyber-suraksha.ai, which brings together representatives from market infrastructure institutions, regulated entities, clearing corporations, depositories, stock exchanges, and other stakeholders. The group has been tasked with examining cybersecurity risks linked to AI-based systems, developing uniform mitigation strategies, sharing threat intelligence, and reviewing vulnerabilities and cyber incidents across the securities market ecosystem. It will also assess the cybersecurity posture of third-party vendors and application service providers.

India's Securities Market Highly Interconnected

The regulator noted that India's securities market is highly interconnected, meaning that a failure or breach in one part of the system could have cascading effects across multiple participants. Therefore, SEBI emphasized the need for coordinated monitoring, information sharing, and rapid response mechanisms to prevent systemic disruption.

Read also: US-Iran Tensions Spark Uptick in Oil Prices Amid Global Market Decline

Security Expectations for Regulated Entities

Alongside the advisory, SEBI outlined a set of security expectations for regulated entities and their service providers. These include:

• Continuous system updates and patch management
• Regular vulnerability assessments
• Stronger oversight of third-party vendors
• Strict security controls for application programming interfaces
• Real-time monitoring through security operations centers
• Improved automated response systems
• Faster onboarding into centralized market cybersecurity infrastructure operated by exchanges

Periodic Risk Assessments and Secure System Configurations

The advisory further calls for periodic risk assessments that include scenario testing for cyber threats, the adoption of secure system configurations, and the implementation of advanced security architectures such as Zero Trust models. Regulated entities are also required to maintain updated inventories of critical systems and software components, including open-source dependencies, and to ensure that any system changes undergo structured review, testing, and documentation.

Long-Term Integration of AI into Cybersecurity Frameworks

SEBI added that regulated entities should begin planning for long-term integration of artificial intelligence into cybersecurity frameworks, including the use of AI for threat detection and automated defense, while ensuring that associated risks are continuously reassessed.