SBI’s cyber defences under scrutiny; its Cyber Defence Centre to be operational by FY27

The suspected customer-data exposure at State Bank of India (SBI) has brought its cybersecurity preparedness into focus, despite the bank reporting an extensive array of safeguards in its annual disclosures.

SBI’s FY2025–26 Sustainability Report and Annual Report, published before the reported exposure, detail its security audits, automated threat monitoring, incident-response procedures and employee training. The disclosures also outline plans to further integrate its cyber-defence operations.

Extensive audits, limited disclosure

SBI’s Sustainability Report says information-systems audits covered 427 IT systems during FY26. Audits of outsourced IT activities covered 695 activities, while internal and external cybersecurity audits covered 176 IT applications and infrastructure and 151 systems, respectively.

However, the report does not disclose the findings, the number of vulnerabilities identified or how many were rectified. SBI reported “nil” instances of data breaches during FY26.

Monitoring and testing

The bank’s Global Cyber Security Operations Centre (GCSOC) continuously monitors critical information systems for threats and unauthorised access. Automated tracking of indicators of compromise (IoCs)—digital clues that may signal cyberattacks—has replaced a previously manual process.

SBI also monitors phishing, fraudulent websites, brand impersonation, vishing and rogue mobile applications, pursuing the removal of malicious links and websites.

Its Annual Report cites an automated Secure Configuration Monitoring System covering more than 85,000 IT assets. AI-driven intelligence platforms, risk profiling and continuous monitoring of digital transactions help identify suspicious activity.

Security testing includes ethical hacking, vulnerability assessments, penetration testing and red-team exercises across websites, mobile applications, databases, networks and internal systems. Monthly domain-password-spray tests seek to identify employees using easily guessed passwords.

Firewalls, encryption, multi-factor authentication and data-loss prevention tools provide additional safeguards.

Response and accountability

CERT SBI serves as the central first responder to cyber incidents. Its response framework covers detection, containment, eradication, recovery and post-incident reviews. A separate Incident Response Wing handles forensic investigations, threat hunting, mock drills and regulatory reporting.

SBI conducted 2,079 information-security and cybersecurity training programmes, benefiting 39,961 employees in FY26. Nearly 1.81 lakh employees had completed mandatory cybersecurity e-learning and assessments by March 31, 2026.

Oversight rests with the Board-level IT Strategy Committee, while the Group Chief Information Security Officer heads the Information Security Department.

The bank cites ISO 27001:2022 and ISO 22301 certifications, PCI DSS compliance and alignment with the Reserve Bank of India’s Cyber Security Framework.

Next phase

SBI plans to transition its next-generation GCSOC into an integrated Cyber Defence Centre combining security operations and incident response. Using advanced automation, machine learning and agentic AI, it is expected to become operational in FY27.

A Cyber Security Centre of Excellence is also planned to strengthen capabilities across SBI and the wider banking, financial services and insurance sector. Both initiatives remain in progress.