'Our cyber defence must evolve faster’: SEBI chief Tuhin Kanta Pandey launches 2 new portals for digital security

SEBI Chairman Tuhin Kanta Pandey on Monday announced two new initiatives to strengthen cybersecurity, incident reporting and information sharing across the securities market ecosystem.

Addressing the SEBI Symposium on Cyber Defence on 17 August, Pandey said, “Cyber threats do not respect organisational boundaries. They do not respect regulatory boundaries. And they certainly do not respect national borders.”

He added that if one institution learns from an attack, that learning should help protect others, while good practices developed by one regulator or country should become a reference point for others.

SEBI launched two new portals

SEBI has launched two new portals to strengthen cybersecurity and information sharing across the securities market ecosystem.

“An incident may begin with one organisation, but the impact may travel through a vendor, a technology platform, a third party or a connected institution,” he said. This makes cyber resilience important not just at the individual-organisation level but across the wider ecosystem.

He noted that “these are not merely technology platforms”, adding that their real value lies in how effectively they enable institutions to share knowledge and take timely action.

1. SEBI Incident Reporting Portal

The revamped SEBI Incident Reporting Portal is designed to make cybersecurity incident reporting “more structured, timely and actionable”, Pandey said.

The portal is aligned with the FSB FIRE (Format for Incident Reporting Exchange), which is intended to bring greater uniformity to incident reporting and reduce friction in cross-border incident reporting.

The initiative is aimed at improving how cybersecurity incidents are reported across the securities market ecosystem, including SEBI-regulated entities.

2. Cyber Suraksha Portal

The second initiative, the Cyber Suraksha Portal, will act as a central hub for sharing cybersecurity-related information.

It will facilitate the sharing of “cybersecurity knowledge, vulnerability warnings, policy measures and incident insights,” Pandey said.

SEBI shifts focus to cyber resilience

“Cyber resilience does not mean assuming that our systems can never be attacked. It means building the capability to anticipate, withstand, respond to, recover from and learn from an attack,” Pandey said.

“Our cyber defence must evolve faster,” he said, stressing the need for the financial sector to keep pace with changing cyber threats.

He also highlighted the need for every organisation to have a tested incident-response and recovery plan, with clear responsibilities and defined processes for responding to an attack.

Vulnerabilities in software, cloud configurations, APIs and third-party dependencies can change continuously, while newer AI models are accelerating both cyberattacks and defence.

Vulnerability management needs to become “continuous, dynamic and risk-driven” rather than a periodic compliance exercise.

He also called for “intelligent, risk-based and increasingly automated patch management”, particularly for critical vulnerabilities, along with rapid deployment and verification that remediation has worked.

SEBI steps up focus on quantum resilience

“Building resilience also means preparing for risks that may not yet be fully visible today. One such area is quantum computing,” he noted.

For this, SEBI has embedded quantum resilience as a core pillar of its cybersecurity and cyber-resilience strategy, aligned with India’s National Quantum Mission.

Pandey said post-quantum cryptography cannot remain a research topic for the future and “has to become a migration programme for today.”

He said financial-sector organisations need to assess where quantum-vulnerable cryptography is being used, which systems and third parties depend on it, how quickly it can be replaced and whether they have “crypto-agility” — the ability to change cryptographic algorithms without redesigning an entire system.

He also highlighted the growing role of AI, automation and advanced analytics in cyber defence, while stressing that “AI for cybersecurity must itself be secure, governed and accountable.”

Disclaimer: This is purely for educational/informational purposes and should not be taken as any sort of investment advice. Always consult a SEBI-registered advisor before making any investment decisions.