Six of the seven forward-looking cyber threat predictions made in last year’s Digital Threat Report have already become a reality, highlighting how the gap between the emergence of new cyber threats and their exploitation has shrunk from years to months or even weeks, according to the second edition of the Digital Threat Report 2025–26 released on Monday.
The report, jointly released by the Ministry of Electronics and Information Technology (MeitY), the Indian Computer Emergency Response Team (CERT-In), the Computer Security Incident Response Team in Finance (CSIRT-Fin) and cybersecurity firm SISA, assesses the evolving cyber risk landscape for the banking, financial services, insurance (BFSI) and digital payments ecosystem.
The report says threats once viewed as emerging—including social engineering, credential theft, supply chain compromises, and cloud exploitation—have now become standard attack techniques. It warns that the most damaging cyberattacks increasingly masquerade as legitimate user activity, approved payments or routine workflows, making them difficult to detect until significant damage has already occurred.
Another major finding is the growing “AI asymmetry” in cyber warfare. The report says artificial intelligence is enabling low-resource attackers to execute sophisticated attacks at machine speed, accelerating offensive capabilities faster than many defensive and regulatory systems can adapt.
To help organisations understand why established security controls often fail, the report introduces an “Anatomy of Cyber Failure” framework, which analyses how multiple layers of weaknesses combine to enable major breaches. It also outlines an 18-month roadmap for financial institutions, recommending a shift from periodic security measures to continuous cyber resilience and stronger security architectures.
Launching the report, MeitY Secretary S. Krishnan said increasing sophistication in cyber threats makes collaboration between government and industry essential for strengthening digital trust.
“As cyber threats become increasingly sophisticated, trusted partnerships between public institutions and industry are essential to strengthening digital trust,” he said, adding that the collaboration between CERT-In, CSIRT-Fin and SISA demonstrates how expertise developed in India can strengthen national cyber resilience while contributing to global cybersecurity knowledge.
CERT-In Director General Sanjay Bahl said cyber resilience must become a shared responsibility as India’s financial ecosystem grows more interconnected and technology-driven.
He said the report calls for moving beyond periodic security interventions towards continuous risk assessment, coordinated incident response and stronger information sharing to help financial institutions anticipate systemic risks and protect trust in the country’s digital financial infrastructure.
SISA Founder and CEO Dharshan Shanthamurthy said cybersecurity must become central to business strategy rather than remain a purely technical function, warning that the narrowing gap between technological innovation and cyber exploitation is reshaping the threat landscape for financial institutions.