Resources Categories
INDUSTRY FACT FILE · BANKING
Market Landscape and the Drivers of Cybersecurity Demand in Banking
The business, technology, regulatory, legal and statutory forces that create cybersecurity, audit and assurance work for banks.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: RBI's 2026 cybersecurity Directions 5. Other regulatory drivers 6. Legal and statutory drivers 7. How the drivers differ by bank type 8. What this means for buyers and for Codec Networks |
1. Market landscape
Indian banking is in the middle of two simultaneous shifts: rapid digitisation of customer channels and lending, and a tightening supervisory rulebook for technology risk. The result is sustained, recurring demand for independent testing, monitoring and assurance.
|
₹48,021 cr Frauds reported by banks and FIs in FY26 (RBI) |
8,640 Advances-related fraud cases in FY26 (RBI) |
28 Regional Rural Banks after the 2025 amalgamation |
7 Entity-specific RBI cyber Directions issued on 31 Jul 2026 |
1.1 Market segments and buying behaviour
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Large public and private sector banks |
Mature security functions with in-house teams; buy specialist testing, independent assurance and capacity for peak demand |
Red teaming, independent VA/PT, CSOC augmentation, third-party assurance, Board advisory |
|
Mid-sized private banks |
Fast digital growth; lean teams relative to scale; strong fintech partnership activity |
Managed SOC, digital channel and API testing, regulatory gap assessments |
|
Foreign bank branches |
Group-defined controls; must evidence Indian requirements and comply-or-explain positions |
Local gap assessments, data localisation validation, evidence packs |
|
Small finance and payments banks |
Digital-first, high volumes, outsourced technology, fraud-sensitive |
Mobile and API testing, fraud and mule monitoring, vendor risk, SOC |
|
Urban co-operative banks |
Graded RBI requirements by digital depth; limited internal capacity; shared-service reliance |
Graded baseline assessments, shared SOC, backup and recovery testing, awareness |
|
Rural co-operative banks and RRBs |
Supervised by NABARD; consolidation and technology upgrades under way |
Infrastructure assessments, CBS security, resilience reviews |
2. Business drivers
These explain why bank management allocates money to cybersecurity.
|
Business driver |
Buying trigger |
Relevant services |
|
Customer trust and deposit franchise |
A breach or fraud wave damages confidence and drives customers away |
Fraud monitoring, digital channel security, incident readiness |
|
Channel availability |
Outages of UPI, internet or mobile banking are immediately visible and reportable |
Resilience and DR testing, capacity and DDoS readiness, CSOC |
|
Fraud losses and reimbursement |
Rising digital and advances-related fraud; customer-protection rules from January 2027 |
Fraud-scenario testing, mule analytics, forensic investigations |
|
Supervisory standing |
RBI inspections, supervisory observations and the new 2026 Directions |
Gap assessments, IS audit support, evidence management |
|
Partnerships and growth |
Co-lending, fintech and BaaS partnerships require secure integration and oversight |
Partner and API assurance, third-party risk management |
|
Cost and efficiency |
Too many tools, too many alerts and too few specialists |
Managed SOC, SOC tuning, consolidated assurance programmes |
|
Board accountability |
Directors are explicitly responsible for technology and cyber risk |
Board training, risk dashboards, cyber risk quantification |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Mobile and internet banking growth |
Account takeover, malware, phishing and rogue apps |
Mobile and web application testing, anti-phishing and rogue-app monitoring |
|
UPI, IMPS and real-time rails |
Fraud moves in seconds; mule accounts move proceeds fast |
Real-time monitoring use cases, mule detection, transaction-risk reviews |
|
Open APIs and fintech integration |
Broken authorisation, data oversharing, leaked partner credentials |
API security testing, partner assurance, secrets scanning |
|
Cloud and core modernisation |
Misconfiguration, migration errors, shared-responsibility gaps |
Cloud posture reviews, migration security assessments |
|
Legacy systems |
Unsupported components and difficult patching |
Infrastructure VAPT, compensating-control reviews, segmentation |
|
AI and automation |
Model manipulation, data leakage, deepfake-assisted fraud |
AI/LLM security testing, deepfake simulations, AI governance |
|
Shared services |
ATM switch providers and shared infrastructure as indirect attack paths |
ATM switch provider assessments, vendor control validation |
Figure 3: The four groups of drivers behind cybersecurity spending in banking.
4. Regulatory drivers: RBI's 2026 cybersecurity Directions
On 31 July 2026 RBI issued entity-specific Directions titled 'Cybersecurity, Technology: Risk, Resilience and Assurance Framework' for commercial banks, small finance banks, payments banks, urban co-operative banks, All India Financial Institutions, NBFCs and credit information companies. They came into effect immediately and repealed the earlier cybersecurity and IT governance instructions for these entities. The commercial bank Direction (RBI/DoS/2026-27/410) sets out the following requirements.
|
Area |
Key requirements (commercial banks) |
|
Board and governance |
Board approves technology and cybersecurity policies, reviewed at least annually IT Strategy Committee of at least three directors, chaired by an independent director with at least seven years of substantial IT experience, meeting at least quarterly; the ITSC reviews BCP/DR adequacy at least annually |
|
CISO |
CISO at General Manager or equivalent level, with no direct reporting to the Head of IT and no business targets Reports to the Executive Director overseeing risk management and presents cyber risk reviews to the Board, Risk Management Committee or ITSC at least quarterly |
|
Security testing |
Vulnerability assessment at least once every six months and penetration testing at least once every 12 months for critical systems and DMZ systems with customer interfaces; risk-based approach for other systems Testing by trained, independent experts; testing after new implementations and major changes; application security testing throughout the lifecycle |
|
Cyber Security Operations Centre |
A CSOC for continuous surveillance, with round-the-clock Level 1 monitoring and Level 2 and Level 3 capabilities for root-cause analysis, forensics and malware analysis Subscription to anti-phishing and anti-rogue-app services; threat intelligence briefings to the Board/ITSC |
|
Resilience |
DR drills for critical systems at least half-yearly, with DR operating for at least a full working day A documented Cyber Crisis Management Plan; participation in cyber drills conducted by bodies such as CERT-In and IDRBT |
|
Incident reporting |
Cyber incidents reported to RBI on the DAKSH platform within six hours of detection; CERT-In to be notified proactively |
|
Third parties |
Baseline controls for third-party ATM switch service providers, built into contracts Audit and RBI inspection rights for IT and cyber third-party arrangements not covered by RBI's outsourcing directions; source code or escrow for critical applications |
|
Data and access |
Data leak prevention covering endpoints, data in transit and at rest; MFA for privileged users of critical systems; DMARC for e-mail Customer notification through alternate channels for payments above a customer-set value |
|
IS audit |
The Audit Committee of the Board oversees IS audit and approves and reviews the IS Audit Policy at least annually; audit planning is risk-based |
|
Other bank types Small finance banks and payments banks received Directions with the same title on the same date (RBI/DoS/2026-27/419 and /428). Urban co-operative banks received a Direction (RBI/DoS/2026-27/437) that grades banks into four levels by digital depth and interconnectedness, with requirements accumulating by level. Foreign bank branches follow a 'comply or explain' approach for specified chapters of the commercial bank Direction. Regional Rural Banks and rural co-operative banks are supervised by NABARD and follow the cybersecurity framework applicable to them. |
5. Other regulatory drivers
|
Instrument |
Applies to |
Key cybersecurity relevance |
|
RBI Managing Risks in Outsourcing Directions, 2025 |
Banks and other regulated entities |
Due diligence, contracts, audit and access rights, and oversight of outsourced services, including IT |
|
RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025 (in force 1 April 2026) |
Payment system providers and participants, including banks |
At least two factors of authentication with at least one dynamic factor; flexibility beyond SMS OTP |
|
RBI customer-protection framework for fraudulent electronic banking transactions (amendment issued 24 June 2026) |
Banks, for transactions on or after 1 January 2027 |
Broader liability regime; burden of proving customer liability on banks; time-bound complaint resolution |
|
RBI Storage of Payment System Data (6 April 2018) |
Banks as payment system participants |
Payment system data to be stored only in India; compliance audit |
|
RBI KYC directions (including V-CIP) |
Banks and other regulated entities |
Secure video-based customer identification, data protection and record keeping |
|
RBI fraud risk management directions |
Banks |
Fraud risk governance, early warning signals, and reporting of frauds |
|
SWIFT Customer Security Programme |
Banks using SWIFT |
Mandatory and advisory controls with annual attestation and independent assessment |
|
PCI DSS v4.0.1 and card network rules |
Card issuing and acquiring banks |
Cardholder data protection, payment-page script controls (mandatory from 31 March 2025) |
Figure 4: Regulatory timeline for banking cybersecurity, as of October 2026.
6. Legal and statutory drivers
|
Law or obligation |
Relevance to banks |
Demand created |
|
Banking Regulation Act, 1949 and RBI Act, 1934 |
Basis for RBI regulation and supervision of banks; co-operative banks brought under fuller RBI supervision by the 2020 amendment |
Regulatory audits, supervisory responses, governance |
|
Payment and Settlement Systems Act, 2007 |
Banks' participation in payment systems |
Payment security and data storage compliance |
|
IT Act, 2000 and CERT-In Directions (28 April 2022) |
Report specified incidents within 6 hours; retain ICT logs for 180 days in India; synchronise clocks with NIC or NPL |
Logging assurance, incident readiness, SOC, forensics |
|
Digital Personal Data Protection Act, 2023 and Rules, 2025 |
Phased commencement: most obligations, including security safeguards and breach intimation, from May 2027 |
Data mapping, consent, safeguards, breach workflows |
|
Prevention of Money Laundering Act, 2002 |
Reporting entity obligations and FIU-IND reporting |
Transaction-monitoring reviews, investigations support |
|
Contracts and network rules |
Card networks, SWIFT, NPCI, outsourcing and fintech partner agreements |
Independent assessments and partner assurance evidence |
7. How the drivers differ by bank type
|
Bank type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Public sector banks |
Trust, availability, government business |
Legacy modernisation, scale, ATM networks |
2026 commercial bank Direction, outsourcing, CERT-In |
|
Private sector banks |
Digital growth, fintech partnerships, fraud |
Mobile, APIs, cloud, AI |
2026 commercial bank Direction, Authentication Directions, DPDP |
|
Foreign bank branches |
Group standards, client trust |
Group platforms, offshore services |
2026 Direction (comply or explain), data localisation |
|
Small finance banks |
Inclusion growth, fraud control |
Mobile-first, outsourced technology |
2026 SFB Direction, KYC, outsourcing |
|
Payments banks |
Transaction volumes, agent networks |
Digital payments, devices |
2026 payments bank Direction, PSS, Authentication |
|
Co-operative banks |
Member trust, survival and consolidation |
CBS upgrades, shared services |
2026 UCB Direction (graded) or NABARD framework |
8. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“We must align to RBI's 2026 Directions.” |
Gap assessment and remediation roadmap |
Quarterly evidence reviews and annual reassessment |
|
“We need six-monthly VA and annual PT.” |
VAPT assurance programme |
Scheduled testing calendar with retesting |
|
“We need a CSOC with L1–L3 capability.” |
Managed or co-managed CSOC |
24x7 monitoring, threat hunting and reporting |
|
“We must report incidents within six hours.” |
Incident response retainer and playbooks |
Drills, tabletop exercises and on-call response |
|
“Our vendors and partners are our biggest risk.” |
Third-party and ATM switch provider assurance |
Annual vendor assessments and continuous monitoring |
|
“Our Board needs clear cyber risk reporting.” |
Board and ITSC advisory |
Quarterly CISO and Board reporting support |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document summarises regulatory and legal instruments as published up to October 2026. It is not legal advice. Requirements differ by bank category; confirm obligations against the current official text of each Direction, including amendments.