To address these concerns, Sebi has constituted a task force named cyber-suraksha.ai, comprising representatives from market infrastructure institutions (MIIs), qualified registrar and transfer agents (QRTAs), regulated entities and other stakeholders.
In a circular, Sebi said the rapid evolution of AI-driven tools capable of identifying system vulnerabilities at scale could expose financial institutions to heightened cybersecurity risks, including potential exploitation of weaknesses, data confidentiality concerns and issues related to the reliability of outputs.
“Due to the interconnectedness and interdependency of market participants in the securities market ecosystem, a periodic coordinated approach for vulnerability management, information sharing and monitoring/assessment is required to prevent a cascading impact,” Sebi said.
The task force will examine cybersecurity risks arising from AI-based models, develop mitigation strategies, facilitate sharing of threat intelligence and best practices, and ensure timely reporting of cyber incidents and vulnerabilities, the regulator added.
The task force will also review the cybersecurity posture of third-party service providers and vendors.
The regulator said a meeting of the task force has already been held to assess risks posed by AI platforms like Mythos and to discuss mitigation measures.Based on these deliberations, Sebi has issued a detailed advisory outlining steps for strengthening cybersecurity frameworks.
These include regular vulnerability assessments using both conventional and AI-based tools, timely patching of systems, enhanced monitoring through security operations centres, strengthening API security, periodic risk assessments and adoption of measures, such as zero-trust architecture, to minimise attack surfaces.
Sebi has also asked market participants to closely coordinate with third-party vendors to ensure the timely deployment of security updates and undertake comprehensive risk assessments related to AI-led systems.
The regulator further directed eligible entities to onboard the Market Security Operations Centre (M-SOC) set up by exchanges for real-time monitoring and threat detection, in view of the rising risks from AI-driven cyber threats.