As AI accelerates both cyberattacks and cyber defence, financial institutions must move from fragmented security controls to coordinated enterprise resilience.
India’s financial ecosystem is increasingly digital, interconnected and dependent on real-time services. This creates opportunities for innovation, but it also increases the potential impact of a cyber incident.
Artificial intelligence is adding another dimension to the challenge. Attackers can use AI to improve the speed, scale and personalisation of malicious activity, while financial institutions are deploying AI to strengthen threat detection, security operations and incident response.
A report by the Data Security Council of India (DSCI) and Boston Consulting Group (BCG), Cybersecurity in the Age of AI: Building a Synchronous BFSI Enterprise, examines this changing landscape and calls for a more coordinated approach to cyber resilience.
The numbers point to a changing threat landscape
The DSCI–BCG research reports that 76% of surveyed Indian BFSI CISOs rank AI-enabled attacks among their top four priorities for 2026; 83% of surveyed institutions are embedding AI into cyber operations; 71% have reached AI-assisted security operations centre maturity or higher; and 49% have mature third-party risk controls and security. These figures describe the report’s survey population, not every Indian financial institution.
Cybersecurity cannot remain confined to the IT department
Cyber incidents can affect payment services, customer access, lending operations, regulatory obligations and institutional reputation. Boards and executive leadership therefore need visibility into material cyber risks, business exposure, response readiness and recovery capabilities. Cybersecurity priorities should be connected to business continuity, customer trust and the organisation’s risk appetite.
This requires closer coordination between the CISO, CIO, CTO, risk, compliance, operations, procurement and business leadership.
AI must be secured as well as deployed
AI-assisted security tools can help identify suspicious behaviour, prioritise alerts and accelerate investigations. At the same time, institutions must assess risks involving sensitive data, model manipulation, unauthorised access, inaccurate outputs and excessive automation. Human oversight, access controls, testing, monitoring and clear accountability remain essential.
Third-party risk deserves greater attention
Banks increasingly depend on technology vendors, cloud providers, payment processors, fintech platforms and interconnected service partners. A weakness in one part of this ecosystem can create exposure elsewhere. Security assessments should include vendor access, API security, data handling, incident notification and recovery arrangements.
Five priorities for BFSI cyber leaders
- Board-level oversight: link cyber risk reporting to business impact and enterprise resilience.
- AI-ready defence: use AI responsibly to improve threat detection and incident response.
- Secure AI adoption: assess and monitor risks throughout the AI lifecycle.
- Third-party assurance: strengthen controls around vendors, APIs and critical service providers.
- Resilience testing: regularly test incident response, recovery and business continuity.
The BFSI NXT perspective
The next stage of cybersecurity will be defined not just by the tools institutions deploy, but by how effectively people, processes, technology and partners work together. Cybersecurity is no longer only an IT checklist. It is a boardroom responsibility and a foundation of trusted digital finance.
Related reading
- India’s Digital Finance Boom Raises the Stakes for Cybersecurity
- From Fraud Alerts to Financial Crime Intelligence: A New Playbook for Lenders
