In a direct message to corporate leadership across India’s capital markets, Securities and Exchange Board of India Chairman Tuhin Kanta Pandey has declared that cyber defence can no longer be treated as a routine back-office IT function. Speaking at the inaugural session of SEBI’s five-day Symposium on Cyber Defence in Mumbai, the capital markets chief emphasized that rising threat sophistication demands an immediate shift toward board-level cyber resilience.
The regulatory chief underscored that the central question for market intermediaries and financial institutions is no longer whether a digital attack will occur, but how rapidly an organization can detect, isolate, and recover from a breach.
From Compliance Checklists to Boardroom Governance
The regulator’s call for heightened executive oversight comes at a critical juncture for Indian financial infrastructure, where rapid digitization has expanded potential attack surfaces across stock exchanges, depositories, and asset management firms. In recent months, market enforcement actions have demonstrated that regulatory authorities are increasingly holding systemically important institutions accountable for operational vulnerabilities and delayed response protocols.
Under the regulatory framework articulated by the Chairman, corporate boards must move beyond passive compliance reports and actively oversee risk-based patching schedules, continuous vulnerability management, and tested disaster recovery architecture. Directors are expected to evaluate cyber risks with the same rigor traditionally reserved for financial solvency, capital allocation, and strategic expansion.
The shift reflects a broader global consensus that financial market infrastructure cannot rely on perimeter defenses alone when dealing with state-sponsored actors and distributed syndicates. Board members must now ensure that technical teams possess the mandate and financial capital required to build resilient architectures capable of maintaining business continuity during active security incidents.
Digital Infrastructure and Shared Threat Intelligence
To support this systemic transition, SEBI launched two centralized digital platforms designed to streamline threat intelligence sharing and incident response across the capital markets ecosystem. The new SEBI Incident Reporting Portal introduces structured, standardized reporting mechanisms aligned with international formats to reduce reporting friction and enable rapid cross-border coordination.
Simultaneously, the regulator unveiled the Cyber Suraksha Portal, which will serve as a centralized hub for disseminating real-time vulnerability warnings, threat insights, and regulatory guidance. By establishing a shared repository of threat intelligence, market authorities aim to eliminate information silos that historically allowed cybercriminals to execute similar attacks across multiple financial entities.
These institutional mechanisms are designed to foster collective resilience across market infrastructure entities, clearing corporations, and retail brokerage platforms. Regulators emphasized that smaller market participants, who often lack dedicated in-house threat intelligence teams, will benefit directly from real-time advisories generated by centralized surveillance networks.
Post-Quantum Encryption and Future Resilience
Beyond immediate operational vulnerabilities, the regulator urged market institutions to prepare for long-term technological disruptions, specifically highlighting the threat posed by quantum computing to current cryptographic standards. As quantum processing capabilities advance, traditional encryption algorithms that protect sensitive financial transactions and investor registries risk becoming obsolete.
Financial institutions were advised to initiate early roadmaps toward post-quantum cryptography to prevent legacy data systems from remaining exposed to future decryption threats. Transitioning complex financial infrastructure to quantum-resistant encryption will require multi-year technical investments and coordinated testing across interconnected clearing and settlement networks.
The five-day symposium brought together domestic market participants alongside international delegates from fifteen International Organization of Securities Commissions jurisdictions, bringing academic researchers and technology specialists into direct alignment with financial regulators. Through live simulation exercises on a Cyber Range platform, participants were subjected to simulated cyberattacks to stress-test organizational assumptions under real-time pressure.
By combining rigorous board oversight with standardized reporting tools and forward-looking encryption standards, the Union regulator aims to fortify India’s financial markets against systemic cyber disruptions. As trading volumes and digital onboarding accelerate across the country, the strength of India’s capital markets will increasingly depend on the speed with which corporate boards transform cybersecurity into active operational resilience.
