New Delhi

India's financial sector needs to shift from periodic cybersecurity compliance to continuous, risk-driven cyber resilience as threats become increasingly interconnected and sophisticated, SEBI Chairman Tuhin Kanta Pandey said on Monday.

Speaking at SEBI's Symposium on Cyber Defence, being held from August 17-21, 2026, in Mumbai, Pandey stressed that the key question for financial institutions is no longer whether a cyberattack will occur, but how quickly they can detect, contain, recover from and learn from an incident.

The symposium brings together domestic participants and international delegates from 15 IOSCO jurisdictions, along with financial regulators, regulated entities, technology institutions and academia. It is designed to provide hands-on experience through classroom sessions, role play during tabletop exercises and real-time simulation experience using a Cyber Range platform. Pandey urged participants to use the exercises to identify weaknesses in their assumptions and preparedness under pressure.

"Cyber resilience that we see today is the outcome of efforts across a much wider ecosystem--regulators, financial institutions, academia, technology institutions, all contributing in different ways," Pandey said, underscoring the need for greater collaboration across the financial ecosystem.

At the inaugural ceremony, SEBI launched two portals aimed at strengthening information sharing and coordinated responses across the securities market ecosystem. The SEBI Incident Reporting Portal is intended to make cyber-incident reporting more structured, timely and actionable, while aligning with the CIFI format to facilitate greater uniformity and reduce friction in cross-border incident reporting. The Cyber Suraksha Portal will serve as a central hub for sharing cybersecurity knowledge, vulnerability warnings, policy measures and incident insights.

Pandey also called for a fundamental rethink of vulnerability and patch management, arguing that periodic assessments are increasingly inadequate as vulnerabilities in software, cloud configurations, APIs and third-party dependencies evolve continuously. He advocated a cycle of continuous discovery, assessment, prioritisation, remediation and validation, supported by intelligent and increasingly automated patch management.

He highlighted quantum computing as an emerging cybersecurity challenge and said post-quantum cryptography should move from a future research issue to a present-day migration programme. Financial institutions need to identify quantum-vulnerable systems, assess dependencies and build "crypto-agility" to transition between cryptographic algorithms without redesigning entire systems.

READ MORE:Afreen Zeb shaped India's content creator market

Pandey emphasised that cybersecurity is no longer merely an IT concern, but a board-level, business continuity, market integrity and investor confidence issue. He concluded with three priorities,"Co-operate, Prepare, Respond", calling for faster evolution of cyber defence through continuous learning, stronger capabilities and collective resilience.