Digital Threat Report 2025–26: Cyber Risks Reshaping India's BFSI Sector

Digital transformation has changed how banks, financial institutions, and insurance companies deliver services. Cloud computing, artificial intelligence (AI), mobile banking, open banking APIs, and real-time payment systems have improved convenience and operational efficiency. However, these technologies have also expanded the opportunities available to cybercriminals.

The Digital Threat Report 2025–26, developed collaboratively by SISA, the Indian Computer Emergency Response Team (CERT-In), and the Financial Computer Security Incident Response Team (CSIRT-Fin), examines these evolving risks. Its central message is that cybersecurity must move beyond periodic compliance checks and traditional perimeter-based defenses toward continuous monitoring, verification, and operational resilience.

Official reference: Ministry of Electronics and Information Technology, Press Information Bureau, Digital Threat Report 2025–26 launch announcement, July 13, 2026. www.pib.gov.in/PressReleasePage.aspx?PRID=2284051&lang=1&reg=48

According to the report's executive summary, cyber threats are reaching operational impact faster, reducing the time organizations have to identify and contain attacks. In financial services, this acceleration is especially concerning because transactions may be processed instantly and can be difficult to reverse.

The report identifies three broad clusters of risk.

AI and human deception: Deepfakes, phishing, business email compromise, credential theft, and session hijacking undermine trust in people and identities.

Software and systems: API vulnerabilities, business logic abuse, compromised software dependencies, cloud misconfigurations, and AI-related weaknesses threaten application integrity.

Infrastructure and the economy: Mobile and UPI fraud, ransomware, attacks on connected devices, cryptocurrency-related incidents, and future cryptographic risks can affect financial and operational continuity.

The report states that six of the seven forward-looking predictions in its previous edition had reached full-scale realization. This finding illustrates the speed at which anticipated risks can become practical security challenges.

AI is becoming a tool for both defenders and attackers. The report explains that advanced AI systems can assist with vulnerability discovery, exploit development, reconnaissance, and attack coordination. Automation allows attackers to investigate more targets and conduct multiple activities simultaneously.

AI also strengthens social engineering. Deepfake audio and video, convincing phishing messages, and synthetic identities can make fraudulent requests harder to distinguish from legitimate communication.

Financial institutions must therefore strengthen identity verification beyond visual appearance or familiar communication patterns. Risk-based authentication, behavioral monitoring, transaction verification, and adversarial testing of AI systems are increasingly important.

The report also recommends treating AI agents as privileged non-human identities. Their access should be restricted, monitored, and governed through task-specific credentials and appropriate authorization controls.

The report emphasizes that identity has become a central security control across digital financial services. A compromised account or session may provide access across multiple connected applications, partners, and systems.

Multifactor authentication remains important, but it cannot independently prevent every session hijacking or token-replay attack. Organizations should strengthen session security, monitor unusual behavior, review privileged access, and govern machine identities such as service accounts and API credentials.

Payment systems face another challenge: attackers may exploit business logic without triggering conventional malware alerts. Examples include abusing authorization checks, manipulating transaction sequences, exploiting race conditions, or making repeated requests that expose weaknesses in OTP and payment workflows.

The report recommends adversarial business logic testing, protocol-level safeguards, transaction monitoring, and validation of authorization rules under abnormal or concurrent activity.

One of the report's important contributions is its four-layer framework, which explains how multiple weaknesses can combine to produce a successful breach.

Design gaps: Systems may rely on implicit trust or lack adequate threat modeling and secure business logic.

Enforcement gaps: Security controls may exist but fail because of excessive privileges, inconsistent coverage, or insufficient continuous verification.

Signal gaps: Missing telemetry, disconnected logs, detection silos, and weak behavioral baselines prevent security teams from recognizing suspicious activity.

Response gaps: Delayed containment, manual processes, incomplete playbooks, and inadequate recovery procedures allow an incident to cause greater damage.

This framework shows why a breach rarely results from a single technical flaw. Effective defense requires connecting secure design, consistent enforcement, reliable detection, and rapid response.

The report identifies a gap between demonstrating that controls exist and proving that they withstand real attacks. An organization may pass an audit while still having exposed service credentials, unmonitored cloud changes, vulnerable application workflows, or incomplete endpoint telemetry.

It describes three recurring problems: implementation drift, where actual operations move away from the intended control; scope boundary failures, where protection does not cover the full attack surface; and framework evolution lag, where security requirements struggle to keep pace with emerging technologies.

To address these problems, the report recommends continuous control monitoring, regular adversarial validation, runtime security checks, stronger secrets management, and evidence that controls work under realistic attack conditions.

The report proposes a three-horizon roadmap for 2026 and beyond.

First six months: Foundational controls. Deploy phishing-resistant MFA for privileged accounts, inventory non-human identities, test payment business logic, strengthen secrets management, monitor production containers, and improve software supply chain visibility.

Six to twelve months: Continuous capability. Introduce continuous session assurance, behavioral transaction monitoring, AI-probing detection, cloud micro-segmentation, real-time attack surface management, and regular adversarial control validation.

Twelve to eighteen months: Architectural maturity. Expand passwordless authentication, strengthen AI model and software supply chain integrity, implement prompt-injection-aware content controls, and move toward identity-centric access across cloud, SaaS, and on-premises environments.

The roadmap is a reference for prioritization, not a universal prescription. Institutions should adapt implementation to their risk exposure, operational requirements, and maturity.

The Digital Threat Report 2025–26 presents a clear direction for the BFSI sector: cybersecurity must become a continuous business capability rather than a periodic technical exercise. AI-enabled deception, identity compromise, payment logic abuse, and third-party dependencies require coordinated protection across the entire financial ecosystem.

Organizations should prioritize continuous assurance, secure software delivery, behavioral detection, rapid containment, and tested recovery procedures. Collaboration between financial institutions, technology partners, regulators, and incident-response teams is equally important because cyber incidents can spread beyond a single organization.

AESPARROW CONSULTING PVT. LTD. encourages financial organizations to assess their security controls against realistic attack scenarios, strengthen visibility across connected systems, and build resilience into every stage of digital operations.