AI, Digital Identity and Real-Time Payments Reshape Cyber Threat Landscape: Report

The rapid transformation of the banking, financial services and insurance (BFSI) sector is creating a fundamentally new cyber threat landscape, with traditional security frameworks no longer adequate for today's interconnected digital ecosystem, according to the Digital Threat Report 2025-26 released on Monday.

The report, published jointly by the Ministry of Electronics and Information Technology (MeitY) , Indian Computer Emergency Response Team (CERT-In) , Computer Security Incident Response Team in Finance (CSIRT-Fin) and cybersecurity firm SISA , warns that emerging technologies and digital financial services are reshaping how cyberattacks are carried out.

According to the report, conventional cybersecurity architectures were built for centralized systems where trust boundaries were clearly defined. However, modern financial ecosystems now operate through interconnected platforms, embedded finance, AI-driven decision-making, real-time payments, APIs and third-party service providers , significantly expanding the attack surface.

The report notes that attackers are increasingly shifting from direct system compromises to trust-chain manipulation , targeting vulnerabilities across biometric onboarding systems, partner applications, AI-powered decision engines, real-time payment networks, programmable finance platforms and external ecosystems. Cybercriminals are exploiting gaps between systems, institutions and workflows where no single entity has complete visibility or control.

As a result, cyber threats are no longer limited to stolen credentials or fraudulent transactions. Instead, risks are becoming embedded across digital identity systems, artificial intelligence models, APIs, payment logic and supply chains , creating a more complex and interconnected threat environment.

The report highlights that the convergence of real-time transaction irreversibility , AI-driven decision-making, programmable financial logic, continuous identity frameworks and ecosystem-dependent operations is increasing cyber risks by combining speed, complexity and interdependency.

It also cautions that regulatory compliance frameworks are struggling to keep pace with rapidly evolving digital architectures, creating a window of opportunity that sophisticated threat actors are actively exploiting.

A major concern identified in the report is the growing reliance on digital identity as the primary control mechanism for access and transactions. Built on biometrics, continuous authentication signals and cross-system token chains, a single compromised identity can potentially provide persistent access across multiple accounts, platforms and services.

The report further warns that compliance monitoring systems themselves can become targets, with attackers capable of suppressing logs, manipulating alert thresholds and maintaining the appearance of regulatory compliance while operating inside compromised environments. It concludes that the modern cyber threat surface is no longer defined by a fixed perimeter but by a constantly shifting network of relationships spanning partners, platforms, AI models, APIs and infrastructure layers, many of which financial institutions do not fully own or control.