Whalesbook
AI Poses New Cyber Threats to Markets
India's financial markets face growing cybersecurity risks from advanced AI tools, the Securities and Exchange Board of India (Sebi) has warned. Tools like Mythos can quickly find and exploit system weaknesses. Concerns include protecting sensitive data, ensuring application integrity, and trusting AI-generated results.
Sebi Creates 'Cyber-Suraksha.ai' Task Force
To tackle these emerging threats, Sebi has formed a dedicated task force named 'cyber-suraksha.ai'. This multi-stakeholder group includes representatives from market infrastructure institutions, qualified registrars and transfer agents, and other regulated entities. Its main job is to study the cybersecurity challenges posed by AI models.
Developing Strategies to Fight AI Threats
The task force will develop a unified strategy against these AI-driven threats. This involves sharing crucial threat information, establishing best practices for managing vulnerabilities, and creating comprehensive response plans. Sebi expects prompt reporting of cyber incidents, attack methods, and vulnerabilities to strengthen the market's overall defenses.
Mandatory Security Upgrades and Vendor Oversight
Sebi requires market participants to immediately update operating systems and applications with the latest security patches, suggesting virtual patching if immediate fixes aren't available. Regular vulnerability assessments, using both standard and AI tools, are now mandatory, alongside ongoing security audits. Oversight of third-party vendors must also be increased, ensuring they assess AI-driven detection model risks and put strong safeguards in place.
Technical Defenses and Long-Term AI Plans
The regulator emphasizes robust change management, improved API security, and continuous monitoring through Security Operations Centres (SOCs), including the Market SOC (M-SOC). Sebi also called for scenario testing, particularly for AI-driven threats, and adopting Zero Trust Network principles. Firms must prepare long-term plans for AI usage in detection and mitigation, updating their risk management frameworks accordingly.