State Bank of India inaugurated CyRIS, its Cybersecurity Centre of Excellence, in Mumbai on 26 October 2026. Sanjay Lohiya, Secretary in the Department of Financial Services, inaugurated the centre in the presence of SBI Chairman Challa Sreenivasulu Setty to boost threat intelligence and cyber resilience across the financial sector.
What Is SBI CyRIS?
CyRIS is the Cybersecurity Centre of Excellence set up by the State Bank of India (SBI) in Mumbai. It acts as a central hub that brings cyber policy, training, research, innovation, threat intelligence and cyber defence together on one platform.
The centre is designed to move SBI from reacting to attacks after they happen to anticipating threats before they cause harm. This anticipatory and intelligence led approach means the bank studies early warning signs, shares information quickly and prepares its systems in advance.
CyRIS is meant to serve not only SBI but the wider banking, financial services and insurance sector. It will work with government bodies, regulators, other banks, fintech companies, academic institutions and technology partners, because most cyberattacks now cross organisational boundaries.
How the Three Pillars of THINK, INNOVATE and DEFEND Work
SBI has built CyRIS around three complementary pillars. Each pillar has a clear role, from setting rules and building skills to creating new tools and stopping live attacks.
| Pillar | Focus Areas | What It Does |
|---|---|---|
| THINK | Cyber policy, Cyber Academy, citizen centric initiatives | Shapes cybersecurity rules, trains staff and spreads awareness about safe digital banking |
| INNOVATE | Research, innovation, benchmarking | Develops new security solutions and measures SBI’s cyber strength against global practices |
| DEFEND | Cyber defence, threat intelligence, cyber resilience | Detects threats early, responds fast to incidents and keeps banking services running during attacks |
The THINK pillar strengthens governance and people. It includes a Cyber Academy for training and certification along with public awareness work on fraud prevention.
The INNOVATE pillar focuses on research and testing of new ideas, including live proof of concepts. It also benchmarks SBI’s maturity so gaps can be found and fixed.
The DEFEND pillar handles active protection. It covers threat hunting, incident response, threat intelligence advisories and preparedness drills so the bank can contain an attack quickly.
What Is Threat Intelligence and Cyber Resilience in Banking?
Threat intelligence is organised information about cyber attackers, their methods and early warning signs. In banking, it means collecting data from network logs, fraud reports, dark web monitoring and partner banks to predict which systems or customers may be targeted next.
Cyber resilience is the ability of a bank to keep working during and after a cyberattack. It covers anticipation of threats, ability to withstand an attack, containment of damage, recovery of services and learning from the incident to become stronger.
Cybersecurity in banking applies both ideas to protect money, data and payment systems. SBI has listed key technical areas where CyRIS will build depth:
- Threat intelligence and cyber defence for early detection and coordinated response
- Digital forensics and malware analysis to study how an attack happened and what code was used
- Ethical hacking and red team exercises to find weak spots by testing systems like an attacker
- Fraud analytics to spot unusual transactions and stop fraud in real time
- AI security to protect artificial intelligence systems from misuse and to use AI for faster fraud detection
- Quantum safe technologies to prepare encryption for a future when quantum computers could break current codes
Why SBI Launched CyRIS Now
The launch follows a suspected data exposure that underlined how fast banks must detect and share threat information. On 16 October 2026, SBI received alerts from its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about suspected exposure of customer data on the dark web.
In a stock exchange filing, SBI said preliminary analysis of about 375,000 records found online identified 3,897 customer records with personally identifiable information such as names, mobile numbers, dates of birth, email addresses and loan related metadata. The bank activated its incident response protocols and appointed an independent CERT-In empanelled agency to check the authenticity, source and extent of the exposure. It said core operations and business continuity were not materially affected, and a root cause analysis is still in progress.
The incident also pushed wider action. SBI Chairman Challa Sreenivasulu Setty, who also chairs the Indian Banks’ Association (IBA), said the industry is working on structured sharing of cyber incident information and testing of artificial intelligence models in a controlled sandbox before wider use. Faster sharing helps other banks block similar attacks early.
The timing also fits tighter regulation. The Reserve Bank of India (RBI), India’s central bank headquartered in Mumbai, issued the Commercial Banks Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions, 2026 on 31 July 2026. The directions require board approved cybersecurity and information security policies, continuous monitoring through a Cyber Security Operations Centre, vulnerability assessment and penetration testing, and reporting of cyber incidents on the RBI’s DAKSH portal within six hours of detection along with proactive notice to CERT-In.
How SBI Already Defends Its Digital Systems
CyRIS adds a knowledge and capability layer on top of defences SBI already reports. The bank runs a Global Cyber Security Operations Centre that monitors critical systems round the clock. It tracks indicators of compromise, which are digital clues that may signal an attack, along with phishing sites, fake apps and brand impersonation.
Security testing includes ethical hacking, vulnerability assessment, penetration testing and red team drills across websites, mobile apps, databases and networks. An automated Secure Configuration Monitoring System covers more than 85,000 IT assets. Firewalls, encryption, multi factor authentication and data loss prevention tools add further layers. A central incident response setup handles detection, containment, recovery and forensic study.
People remain a key focus. In FY26, about 1.81 lakh of SBI’s roughly 2.45 lakh employees completed mandatory cybersecurity e-learning. The bank also ran 2,079 information security training programmes covering 39,961 employees, along with customer awareness drives on digital safety.
SBI plans to evolve its operations centre into an integrated Cyber Defence Centre in FY27 using automation, machine learning and agentic AI. CyRIS will support that shift by linking policy, research and threat intelligence more closely to live defence.
SBI at a Glance and Its Role in Financial Sector Security
SBI stands for the State Bank of India. It is India’s largest public sector bank by assets and deposits, headquartered at State Bank Bhavan in Nariman Point, Mumbai. The bank was constituted on 1 July 1955 under the State Bank of India Act, 1955, taking over the Imperial Bank of India, whose roots go back to the Bank of Calcutta founded in 1806.
SBI serves more than 53 crore customers through over 23,000 branches and about 63,500 ATMs, with Chairman Challa Sreenivasulu Setty leading the bank since 28 August 2024. The Department of Financial Services (DFS) under the Ministry of Finance oversees public sector banks, and Secretary Sanjay Lohiya inaugurated CyRIS.
Because of its size, SBI’s cyber health affects trust in the whole payment system. Its threat alerts flow to CERT-In, India’s national agency for cyber incident response set up in 2004 under the Ministry of Electronics and Information Technology and headquartered in New Delhi, and to forums such as the Institute for Development and Research in Banking Technology (IDRBT) in Hyderabad, which runs the Indian Banks Centre for Analysis of Risks and Threats for sharing intelligence among banks.
Key Takeaways
- SBI inaugurated CyRIS, its Cybersecurity Centre of Excellence, in Mumbai on 26 October 2026.
- CyRIS is built on three pillars of THINK, INNOVATE and DEFEND covering policy, research and active cyber defence.
- The centre focuses on threat intelligence, digital forensics, ethical hacking, fraud analytics, AI security and quantum safe technologies.
- The launch followed alerts on 16 October 2026 about suspected exposure of 3,897 customer records out of about 375,000 records found on the dark web.
- In FY26, about 1.81 lakh of SBI’s 2.45 lakh employees completed mandatory cybersecurity e-learning.
