The Securities and Exchange Board of India (Sebi) has strengthened its cybersecurity framework by introducing two new portals designed to help financial market participants report and tackle cyber threats more efficiently.
The regulator launched the Incident Reporting Portal and the Cyber Suraksha Portal on Monday. The initiative comes as cyberattacks grow increasingly sophisticated and pose risks not only to individual organisations but to the broader financial ecosystem.
Addressing Sebi’s Cyber Defence Symposium, chairman Tuhin Kanta Pandey said the emphasis should now move beyond simply determining whether an organisation is secure to ensuring that the entire financial ecosystem can withstand, contain and recover from cyber incidents.
INCIDENT REPORTING PORTAL TO SPEED UP REPORTING
The new Incident Reporting Portal will give market intermediaries a structured mechanism to report cybersecurity incidents to Sebi.
The system follows the format recommended by the Financial Stability Board, which is expected to bring greater consistency and speed to cyber incident reporting across the securities market.
Faster reporting has become increasingly important because an attack on one institution can potentially spread to others through vendors, technology platforms, third-party service providers and interconnected systems.
CYBER SURAKSHA PORTAL TO FACILITATE THREAT SHARING
The Cyber Suraksha Portal will function as a central platform for sharing cybersecurity-related information across the securities market.
It will consolidate vulnerability alerts, cybersecurity knowledge, policy updates and lessons from previous incidents.
The objective is to enable market participants to identify emerging threats and take preventive measures instead of waiting until an attack occurs.
SEBI CALLS FOR CONTINUOUS VULNERABILITY ASSESSMENTS
Pandey stressed that cybersecurity should not be treated as a periodic compliance requirement.
With software, cloud infrastructure, application programming interfaces (APIs) and third-party services constantly evolving, new vulnerabilities can emerge even after routine security assessments have been completed.
He said organisations must continuously identify vulnerabilities, evaluate their risks, prioritise them, address them and subsequently verify whether the corrective measures have been effective.
The increasing adoption of artificial intelligence makes this approach even more critical. While AI can strengthen cyber defences, it can also enable attackers to launch faster and more sophisticated attacks.
FROM CYBERSECURITY TO CYBER RESILIENCE
Pandey said financial institutions should operate on the assumption that cyber incidents are inevitable.
The key issue, therefore, is how quickly an organisation can identify an attack, limit its impact and restore normal operations.
He emphasised the need for every institution to maintain a clearly defined incident response and recovery plan and to test it regularly rather than simply keeping it as a document.
Such plans should establish who will take decisions during an attack, who will isolate compromised systems, who will coordinate with regulators and other stakeholders, and how critical services will be restored securely.
CYBER RESILIENCE REQUIRES AN ECOSYSTEM-WIDE EFFORT
The Sebi chairman said building cyber resilience cannot be the responsibility of regulators or individual financial institutions alone.
Regulators, financial institutions, technology companies, market infrastructure institutions, academia and other regulated entities all have a role in strengthening the system.
As financial networks become increasingly interconnected, a vulnerability in one segment can quickly create risks for others. Through the two new portals, Sebi aims to build a more resilient financial ecosystem capable of preventing, detecting, containing and recovering from cyberattacks.
