The second edition of the Digital Threat Report 2025-26 was jointly released by the Ministry of Electronics and Information Technology (MeitY), the Indian Computer Emergency Response Team (CERT-In), the Computer Security Incident Response Team in Finance (CSIRT-Fin) and cybersecurity firm SISA. The report focuses on the banking, financial services, insurance and digital payments ecosystem, and draws on digital forensics research, incident response data and analysis of adversarial AI use.

Its central finding is a shift away from direct system compromise toward what the report calls trust-chain manipulation — attackers targeting biometric onboarding, partner applications, AI-driven decision-making, real-time payments and APIs rather than simply attacking passwords or transactions head-on. Social engineering and business email compromise attacks have intensified, the report noted, while credential theft and session hijacking have become the dominant way attackers gain initial access. Perhaps more strikingly, the report said phishing attempts have become sophisticated enough to be context-aware, making them almost indistinguishable from legitimate communication — a shift that has made BFSI the most targeted sector overall.

Underlying much of this is what the report's authors describe as AI asymmetry: offensive capabilities are advancing faster than defensive ones, letting comparatively low-resource attackers carry out operations that once required specialist teams and weeks of manual effort. The report noted that six of seven predictions from last year's edition have already materialised, illustrating how quickly threats are moving from emergence to active exploitation — a gap that's narrowed from years down to months or even weeks.

MeitY Secretary S. Krishnan, speaking at the report's launch, said trusted partnerships between public institutions and industry are essential to strengthening digital trust, calling the report a meaningful collaboration between CERT-In, CSIRT-Fin and SISA. CERT-In Director General Dr Sanjay Bahl said cyber resilience must be treated as a shared responsibility across institutions, regulators and the broader digital supply chain as India's financial ecosystem becomes more interconnected and real-time. SISA founder and CEO Dharshan Shanthamurthy said the narrowing gap between innovation and exploitation changes how the industry needs to defend itself.

To address the risks identified, the report recommends making active liveness detection standard for digital onboarding, adopting continuous session assurance through behavioural biometrics and device monitoring, and extending identity governance beyond human users to cover service accounts, machine identities and autonomous AI systems as well.

The report's release follows a separate industry study by the Boston Consulting Group and the Data Security Council of India, published earlier this year, which found cyberattacks on Indian BFSI institutions have roughly doubled since 2021 and now occur at 1.6 times the global average — with mid-sized institutions facing the highest exposure due to comparatively lower cybersecurity spending.