AI-powered cyberattacks India's top financial system risk: RBI report

Artificial intelligence-enabled cyberattacks have emerged as the biggest near-term cyber risk facing India's financial system, with banks and non-banking finance companies (NBFCs) identifying them as their top concern over the next 12 months, the Reserve Bank of India (RBI) said in its latest Financial Stability Report (FSR) released on Tuesday.

The central bank said cyber risk has become an increasingly important financial stability concern as rapid digitalisation has expanded the attack surface for malicious actors, exposing financial institutions to service disruptions, data breaches and payment system outages that could undermine public trust.

The RBI's findings are based on a survey of major banks and NBFCs, which showed that AI-enabled cyber threats were perceived as the most significant emerging risk, driven by advances that could increase the sophistication, speed and scale of cyberattacks.

While institutions have begun integrating AI-related risks into their cybersecurity frameworks, preparedness remains uneven. Most respondents classified themselves at the "developing" or "intermediate" stages of AI-enabled threat readiness, with only a small proportion considering their capabilities to be mature.

"The evolving cyber threat landscape necessitates continuous investment in technological and cybersecurity capabilities," the RBI said, adding that institutions would need to strengthen threat monitoring, incident detection, response mechanisms, employee awareness and cyber resilience as AI-driven attacks become more sophisticated.

The survey found that despite the heightened threat environment, financial institutions remained broadly confident in their cybersecurity posture. Nearly 98% of respondents assessed their current cyber risk exposure as ranging from very low to moderate, while critical customer services experienced minimal disruption during 2025-26. Incidents that did occur were largely contained within 24 hours.

However, almost one-third of respondents reported that cyber risks had increased moderately or significantly compared with a year ago, reflecting growing uncertainty in the threat landscape.

The RBI also flagged rising dependence on third-party technology providers as another major vulnerability. Third-party dependency and supply chain risks were ranked the second most significant cyber threat by surveyed institutions.

About 93% of respondents said they were partially or substantially dependent on external vendors for cybersecurity functions such as security operations centre monitoring, cloud security, incident response and threat intelligence. Three-fourths also reported moderate to very high operational dependence on third-party technology providers for critical applications.

The central bank warned that a cyber incident affecting a major technology service provider could quickly spread across multiple regulated entities, amplifying operational disruptions and posing broader financial stability risks.

Geopolitical developments are also adding to cyber concerns. Around 42% of surveyed institutions said geopolitical uncertainty had increased the likelihood of cyberattacks, underscoring the need for heightened vigilance against evolving threat activity.

On the investment front, 81% of respondents reported spending less than 5% of revenue on information technology during 2025-26, although the RBI noted that expenditure levels vary depending on business models and technology strategies.

Encouragingly, cyber preparedness appears to be improving. Around 67% of institutions increased their IT and cybersecurity workforce between March 2025 and March 2026, while 71% reported a rise in cybersecurity spending as a share of their overall IT budgets over the past three years.

The survey also found that Indian financial institutions have strengthened practices in areas such as vulnerability assessments, penetration testing and regulatory reporting of cyber incidents. However, the RBI said employee awareness and cybersecurity training require further improvement, as human error remains one of the most exploited entry points for cyberattacks. It also called for stronger forensic preparedness to improve incident response and support regulatory and law enforcement investigations following sophisticated cyber incidents.