State Bank of India details cyber defences as data exposure brings systems under scrutiny

A suspected customer-data exposure at State Bank of India has put the lender's digital security under close watch, even though its recent reports list many safety measures. The bank's FY2025-26 reports outline security audits, automated threat monitoring, quick response steps, and training programs.

Audit Details And Monitoring

Information-systems audits covered 427 IT systems during the financial year 2026, alongside 695 outsourced IT activities. Internal audits checked 176 IT applications, while external audits covered 151 systems. However, the report does not share audit findings, the count of vulnerabilities found, or how many were fixed, though the bank reported zero data breaches for the year. The Global Cyber Security Operations Centre keeps a continuous watch on critical systems, using automated tracking for digital clues of cyberattacks. The bank also tracks phishing, fake websites, brand impersonation, vishing, and rogue apps to take down harmful links.

Technical Defences And Response

An automated Secure Configuration Monitoring System covers over 85,000 IT assets, backed by artificial intelligence tools, risk checks, and transaction monitoring. Security testing involves ethical hacking, penetration tests, and monthly password tests to catch weak employee passwords. CERT SBI acts as the main first responder, while a separate Incident Response Wing handles forensic checks, threat hunting, and mock drills. SBI ran 2,079 cybersecurity training programs for 39,961 employees, with nearly 1.81 lakh staff finishing mandatory e-learning by March 31, 2026. Oversight comes from a board-level committee and the Group Chief Information Security Officer.

Future Plans And Context

SBI plans to turn its security operations centre into an integrated Cyber Defence Centre using automation and machine learning by fiscal year 2027, alongside a new Cyber Security Centre of Excellence.

Context

Large banks manage vast amounts of customer data and financial transactions, making digital security a top priority for financial regulators. Security audits and monitoring tools help institutions spot risks early, but complex digital systems remain a constant target for online fraud and data threats.