PIB TrackerMeitY's BFSI threat report warns AI-driven cyberattacks are outpacing defences — from years to weeks
MeitY, CERT-In and CSIRT-Fin released the 2nd Digital Threat Report 2025-26 for the banking and financial sector, finding that six of seven of last year's predicted threats have already materialised — and that the gap between a threat emerging and being exploited is shrinking to weeks, driven by adversarial AI.
What happened
- MeitY, with CERT-In, CSIRT-Fin and SISA, released the 2nd Digital Threat Report 2025-26 for the BFSI and payments ecosystem.
- Its central finding: six of seven predictions from last year's report have already fully materialised.
- The time from a threat emerging to being exploited is shrinking from years to months or even weeks.
- Adversarial AI is accelerating threats like social engineering, credential theft and supply-chain attacks into the mainstream.
- MeitY Secretary S. Krishnan stressed public–private partnerships (CERT-In, CSIRT-Fin, industry) to strengthen digital trust.
For Prelims
- CERT-In: The Indian Computer Emergency Response Team (under MeitY) — the national nodal agency for cybersecurity incident response and alerts.
- CSIRT-Fin: The sectoral CSIRT for the financial sector — cyber-incident response for banking/finance, operating under CERT-In.
- BFSI: Banking, Financial Services and Insurance — a critical-information-infrastructure sector and a top target for cyberattacks.
- Adversarial AI: Using AI to enhance attacks (deepfake social engineering, automated phishing, malware) — shrinking the attacker's time-to-exploit.
- Social engineering / credential theft: Tricking users into revealing information or credentials — a leading cause of financial-fraud breaches.
- NCIIPC / CERT-In: India's cyber-defence architecture — NCIIPC protects critical infrastructure; CERT-In handles incident response nationwide.
For UPSC: Anchor this in cyber security for critical (financial) infrastructure — the rising sophistication and speed of AI-driven threats, and India's CERT-In/CSIRT-Fin response architecture. Link BFSI as critical infrastructure, adversarial AI, digital trust, and the public–private model of cyber resilience.
What it is NOT: This is an assessment/report highlighting threat trends, not a breach announcement or a new regulation. It flags rising risks and shrinking response windows for the BFSI sector; it does not report a specific attack.
For Mains
Syllabus: GS3.18 · Linkage L2
Anchor
Securing critical financial infrastructure — as AI accelerates cyber threats, faster, collaborative defence becomes essential.
Substantiation (data)
MeitY/CERT-In/CSIRT-Fin 2nd Digital Threat Report 2025-26 (BFSI): six of seven predicted threats realised; threat-to-exploitation time shrinking to weeks; adversarial AI mainstreaming social engineering and credential theft.
Exemplification
Adversarial-AI phishing/deepfakes, credential theft and supply-chain attacks; CERT-In/CSIRT-Fin public–private response as the countermeasure.
Problematisation
Attackers' AI advantage, the speed of exploitation, third-party/supply-chain risk and a cyber-skills gap strain defenders.
Way-forward
Invest in AI-enabled defence, threat intelligence sharing, zero-trust and resilience testing, and strengthen CERT-In/CSIRT-Fin and cyber skilling.
Position
India's stance: proactive, collaborative cyber resilience and digital trust for a critical, fast-digitising financial sector.
Deploys into: Cyber security and challenges through communication networks (GS3.18 — BFSI threats, adversarial AI) · CERT-In/CSIRT-Fin/NCIIPC architecture · critical-information-infrastructure protection and digital trust.
Ministry of Electronics & IT · 2026-07-13 · PRID 2284051 · PIB source ↗