This BCG and DSCI report on Indian BFSI cyberattacks is honestly quite scary . Because banking,financial services,and insurance is not some random sector ah,this is where people's money,data,insurance details and trust are sitting .
According to joint report by Boston Consulting Group (BCG) and Data Security Council of India (DSCI),Indian banking,financial services,and insurance (BFSI) sector is facing cyberattacks at 1.6 times the global average . That number itself says enough about how exposed sector has become .
And incidents have not just increased slightly. They have more than doubled in four years,going from 1.4 million in 2021 to 2.9 million in 2025 . For any sector,this jump would be worrying,but for BFSI it feels extra serious.
Few things standing out from report:
- Cyber incidents doubled in four years,from 1.4 million in 2021 to 2.9 million in 2025 .
- Mean time to contain a cyber breach in India is now 263 days .
- 76% of Chief Information Security Officers (CISOs) see AI-enabled attacks as top concern for 2026.
And that 263 days number is really uncomfortable. Imagine breach happening and organisation taking that long to fully contain it . In finance sector,even few hours can create chaos,so 263 days feels like warning bell only .
Report also says mid-sized financial institutions are at higher risk because their digital exposure has grown fast due to rapid digitization and interconnected systems,but resources may not have grown at same speed. This part feels very real,because not every institution can spend like biggest banks.
But now AI angle is making whole situation even more complicated. Traditional cybersecurity models are not enough anymore,as attackers are also getting faster and cheaper tools. Nisha Bachani ,Managing Director and Partner at BCG,said,"AI has rewritten economics of cyber risk, compressing the time available for attacks while lowering the cost of launching sophisticated threats."
And tbh,that quote captures problem properly. If attack cost is falling and speed is increasing,then defenders cannot keep working with old playbook. Report says institutions must defend against AI-powered attacks,and also use AI in their own cybersecurity systems.
Vinayak Godse ,CEO of DSCI,also pointed toward cyber risk now getting tied with digital scale and business resilience . Basically,if financial companies want to grow digitally,they also need to secure AI-driven operations properly,otherwise growth itself becomes risky .
At same time,there is some positive signal too. Regulatory engagement is improving and strong cybersecurity baselines are being established. Also,83% of CISOs are integrating AI into their cybersecurity operations,which means sector knows threat is changing.
Still,big question is whether this response is fast enough . Because attackers are already moving at AI speed,and many institutions are still trying to catch up…
