The Indian banking sector is experiencing an unprecedented technological evolution. From AI-driven fraud detection and automated lending decisions to real-time customer analytics and intelligent banking assistants, financial institutions are accelerating digital transformation at scale. However, this rapid technological leap has also unlocked a highly sophisticated cyber risk landscape, one that is increasingly shaped by the emergence of advanced artificial intelligence systems.
Following the recent accidental leak of Anthropic’s “Mythos” AI system1, a frontier AI reportedly capable of autonomously analysing source code, identifying zero-day software vulnerabilities, and chaining multi-stage exploits within hours, the stakes for the global financial sector have never been higher. For Indian banks operating within one of the world’s fastest-growing digital economies, the implications are significant.
The conversation around AI is no longer limited to productivity and innovation. It is now fundamentally about resilience, governance, and regulatory accountability.
The new reality of AI-driven cyber threats
Traditional cyberattacks often required significant manual effort, technical expertise, and time to identify vulnerabilities and execute attacks. Frontier AI systems are changing that equation entirely.
AI-powered threat actors can now potentially:
- analyse banking applications and APIs at machine speed
- Identify exploitable vulnerabilities across complex systems
- automate phishing and social engineering campaigns
- generate realistic synthetic identities for fraud
- adapt attack methods dynamically based on system responses
- accelerate multi-stage intrusion and exploitation chains
For Indian banks, where digital payments, mobile banking, and cloud-based financial ecosystems continue to expand rapidly, the operational exposure is growing in parallel.
The concern is not simply that AI can make attacks more effective. The concern is that AI dramatically lowers the time between vulnerability discovery and exploitation.
The DPDP Act and AI accountability
India’s Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a new level of accountability for organisations processing personal data. For banks, this means AI adoption must now be considered not only from a cybersecurity perspective but also through the lens of privacy governance and regulatory compliance.
Under the DPDP framework, banks acting as Data Fiduciaries are responsible for ensuring that personal data is processed securely, lawfully, and transparently, even when AI systems or external technology providers are involved.
This creates several critical considerations for AI governance:
Security safeguards
The DPDP Act requires organisations to implement reasonable security safeguards to protect personal data. In the context of advanced AI threats, this extends beyond traditional perimeter security to include:
- Protection of AI training datasets
- Monitoring for model manipulation or poisoning
- Securing automated decision-making systems
- Restricting unauthorised AI access to sensitive data
Purpose limitation and data minimisation
AI systems often rely on vast amounts of data for optimisation and model training. However, banks must ensure that data collection remains proportionate and aligned with legitimate processing purposes under the DPDP framework.
Third-party risk management
Many banks rely on external AI providers, cloud vendors, and fintech integrations. The DPDP Act does not remove accountability when processing activities are outsourced. Therefore, governance and assurance over third-party AI systems become essential.
Incident readiness and governance
As AI-enabled cyber threats evolve, incident response models must evolve alongside them. Banks will need governance structures capable of responding to AI-driven attacks that operate at far greater speed and scale than traditional threats.
Building AI resilience in the Indian banking sector
To address the growing AI threat landscape, Indian banks must move beyond reactive security approaches and adopt governance models designed specifically for AI-enabled risk.
Key priorities should include:
- Establishing formal AI governance frameworks
- Embedding privacy-by-design into AI development and deployment
- Conducting adversarial AI and red-team testing
- Strengthening API and cloud security monitoring
- Enhancing identity verification and fraud detection controls
- Training employees on AI-driven phishing and social engineering threats
- Implementing scalable oversight models aligned with DPDP obligations
In the era of AI-driven cyber threats, trust will increasingly depend not only on digital innovation, but on the ability to govern that innovation responsibly and at scale.
Supporting AI governance under the DPDP Act
In many cases, the challenge is no longer whether organisations have AI controls. It is whether those controls can scale effectively as AI adoption accelerates.
The emergence of frontier AI systems such as Anthropic’s “Mythos” signals a fundamental shift in the cyber threat landscape facing the banking sector. AI is no longer simply a business enabler; it is also a force multiplier for cyber risk. For Indian banks operating under the DPDP Act, this creates a new regulatory and operational reality where cybersecurity, privacy, and AI governance are deeply interconnected. The organisations that will remain resilient are not necessarily those adopting AI the fastest, but those embedding accountability, governance, and security into AI ecosystems from the outset.
As a DPO and privacy governance partner, HewardMills supports embedding privacy and compliance into AI-driven transformation programmes through a risk-based and operationally scalable approach.
Our support includes:
- AI governance and risk assessments
- Data Protection Impact Assessments (DPIAs) for AI use cases
- Oversight of automated processing and profiling activities
- Third-party AI governance and vendor assurance
- Monitoring compliance alignment between AI deployment and DPDP obligations
Contact our team today to learn more about how we can support your organisation in strengthening AI governance, enhancing DPDP compliance readiness, and building scalable privacy and cybersecurity frameworks for the evolving digital landscape.
