SEBI Forms Cyber-Suraksha Task Force to Counter Emerging AI-Driven Threats Across Capital Markets — September 18, 2026

In response to the accelerating risks posed by artificial intelligence tools capable of automated vulnerability discovery and exploitation, the Securities and Exchange Board of India (SEBI) has established a specialized task force named cyber-suraksha.ai. The regulatory intervention comes amid mounting concerns that sophisticated AI models, including tools such as Claude Mythos, can scan and weaponize software loopholes at unprecedented speeds and scale.

The markets watchdog warned that the high degree of digital interdependency among Indian stock exchanges, clearing corporations, depositories, brokers, and registrar and transfer agents creates an environment where a single breached endpoint could trigger a cascading failure across the entire financial framework.

Mandate of the Task Force

The newly constituted task force brings together key technical and executive representatives from Market Infrastructure Institutions (MIIs), Qualified Registrar and Transfer Agents (QRTAs), and other regulated entities.

The primary objectives assigned to the group include:

• Evaluating the evolving cyber risk profiles posed by autonomous and generative AI vulnerability detection models.
• Formulating a uniform defense playbook and risk mitigation framework applicable to all regulated market participants.
• Creating protocols for rapid information sharing, threat intelligence distribution, and mandatory high-priority incident reporting.
• Reviewing and auditing the cybersecurity postures of third-party vendors and critical application service providers.

Operational Directives for Market Intermediaries

Alongside the establishment of the task force, SEBI issued an advisory detailing urgent and medium-term security mandates for financial institutions operating in the Indian capital markets. The regulator stressed that traditional, periodic security assessments are insufficient against automated AI-driven exploits.

Key Regulatory Directives:

• Accelerated Patch Management: Regulated entities must promptly deploy software and operating system security updates to prevent known weaknesses from being discovered by automated scanning engines.
• Application Programming Interface (API) Security: Strengthening API endpoints to prevent unauthorized data exposure and credential stuffing attacks on brokerage platforms.
• Round-the-Clock Monitoring: Operating dedicated Security Operations Centres (SOC) and accelerating integration with the sector-wide Market-SOC architecture for synchronized real-time anomaly detection.
• Vendor Ecosystem Scrutiny: Implementing stringent contractual and technical oversight for cloud providers, software vendors, and fintech integrators.

Significance for Indian Investors

India's retail participation has expanded exponentially in recent years, with tens of millions of demat accounts linked to app-based discount brokers and algorithmic execution engines. While AI enhances trading execution and market analysis, its weaponization by malicious actors poses severe systemic risks, ranging from data leaks and account hijacking to flash outages and unauthorized trade routing.

By taking a proactive, ecosystem-wide stance through cyber-suraksha.ai, SEBI aims to ensure that institutional defenses match the pace of offensive artificial intelligence, preserving investor trust and operational resilience in India's financial markets.

Tags: SEBI Cybersecurity BSE NSE Capital Markets FinTech