SEBI on Cybersecurity: Tuhin Kanta Pandey Calls for Stronger Defence Against Quantum Computing Threats

Securities and Exchange Board of India (SEBI) Chairman Tuhin Kanta Pandey has highlighted the growing cybersecurity challenges facing India's financial markets, with particular attention being paid to the risks posed by quantum computing.

Pandey said SEBI teams are engaging with market participants to understand their concerns and gather suggestions on how the securities-market ecosystem can prepare for emerging cyber threats.

The regulator is also considering inputs received through various channels, including social media, before finalising its approach.

Quantum Computing Is a Major Cybersecurity Challenge

According to Pandey, one of the biggest challenges associated with quantum computing is “inventorization”—identifying where an organisation's existing cryptographic systems could be vulnerable.

This process involves preparing a Cryptographic Bill of Materials, which can help organisations identify the cryptographic technologies they use and assess their exposure to future quantum-related threats.

The exercise is expected to serve as an important first step in preparing financial-market participants for the transition to stronger security standards.

Why Post-Quantum Cryptography Is Important

As quantum computing technology develops, conventional cryptographic systems could eventually face new security challenges.

Pandey emphasised the need for organisations to move towards post-quantum cryptography (PQC) rather than continuing to rely solely on older cryptographic standards.

The transition involves several stages, including:

Identifying existing cryptographic systems and vulnerabilities.

Creating a Cryptographic Bill of Materials.

Assessing potential quantum-related risks.

Adopting post-quantum cryptographic standards.

Addressing legacy vulnerabilities and security gaps.

Ensuring systems remain resilient against future threats.

Market-Wide Cybersecurity Approach Needed

Pandey also stressed that cybersecurity cannot be addressed by individual organisations alone.

Smaller brokers and other market participants may have limited resources to maintain sophisticated cybersecurity infrastructure. A coordinated approach at the market level could therefore play an important role.

One possible mechanism is a market-level Security Operations Center (SOC) maintained by an exchange, which could facilitate collective monitoring and cyber-risk management.

SEBI Seeks Suggestions From Market Participants

SEBI is currently engaging with different stakeholders to understand their cybersecurity requirements and concerns.

The regulator is examining suggestions received from market participants and other sources before developing its final position.

This consultation process could help SEBI design cybersecurity measures that account for the different capabilities and risks faced by brokers, exchanges and other participants in India's securities market.

What Happens Next?

The immediate priority is expected to be awareness, assessment and cryptographic inventory. Once organisations understand where their existing systems could be exposed, they can begin planning the transition towards post-quantum security standards.

For financial institutions and market intermediaries, preparing early could help reduce the risks associated with a future quantum-computing environment.