Vendor Onboarding Due Diligence

Key Takeaways From The Threat Scenario

1. Breaches Are Becoming More Expensive, And More Routine

The average cost of a data breach globally in 2024 is now estimated at $4.88 million, while in India, it stands at $2.18 million—a 10% increase over the previous year. These figures reflect not only rising attacker sophistication but also systemic delays in detection, response, and recovery.

The report notes that while many institutions have invested in advanced tooling, a lack of integration, coordination, and clarity in response planning continues to compound post-breach damage.

2. Phishing, BEC, And Identity Theft Have Grown Sharper And More Scalable

• India experienced a 175% surge in phishing attacks in H1 2024 compared to the same period last year.
• Phishing remains the initial infection vector in 25% of recorded incidents in the BFSI sector.
• 54% of BEC (Business Email Compromise) cases investigated involved pretexting, a technique where attackers construct plausible backstories to deceive employees.
• Generative AI is enabling attackers to craft grammatically flawless phishing emails, removing traditional red flags.
• Deepfake-enhanced impersonations have enabled executive-level fraud, bypassing manual verification protocols.

The report cites the growing availability of “deepfake-as-a-service” platforms and malicious LLMs such as WormGPT and FraudGPT, which are being used to automate social engineering, write malware, and impersonate decision-makers with startling realism.

3. Credential Theft Remains A Central Strategy

• Attackers are acquiring credentials through a combination of phishing, information-stealing malware, and dark web purchases.
• Once acquired, credentials are being used to compromise SSO platforms, VPNs, SaaS applications, and email systems.
• Many attacks bypass multi-factor authentication through session hijacking or exploiting broken object-level authorisation (BOLA) flaws in APIs.

One critical observation from the report: SaaS platforms often include sensitive customer information in URLs, which, when paired with stolen session tokens, can lead to broad data exposure with minimal effort.

4. Cloud Infrastructure Is Misconfigured And Actively Targeted

Cloud misconfigurations are listed as a recurring point of failure:

• Exposed storage buckets, default passwords, and poor IAM (Identity and Access Management) policies are frequently observed.
• Threat actors are exploiting cloud tokens exposed in web source code, targeting AWS, Azure, and GCP environments.
• The average time to exploit a known cloud vulnerability post-disclosure is less than eight days, in some cases just hours.

The report features multiple cases, including one where a fintech’s XSS vulnerability in a rich text editor allowed the injection of webshells, ultimately giving attackers access to cloud-stored client data via Amazon S3 buckets.

5. API Weaknesses Are Enabling Payment Fraud

The BFSI sector’s rapid API adoption has created efficiency, but also exposure.

• Hardcoded API keys, reused credentials across environments, and predictable authorisation patterns are key issues.
• One documented case saw attackers conduct a replay attack, where they successfully mimicked legitimate bank transfer requests through APIs, executing unauthorised payments while leaving wallet balances untouched.
• Cross-Origin Resource Sharing (CORS) misconfigurations were also cited as enabling unauthorised access from untrusted domains.

6. Supply Chain Attacks Are Multiplying

The MOVEit and GoAnywhere breaches are referenced in the report to illustrate the rising threat posed by third-party software providers:

• CL0P ransomware group targeted these platforms, impacting thousands of organisations globally.
• Open-source libraries like XZ Utils were compromised, with attackers introducing a backdoor affecting multiple Linux distributions.
• Malicious libraries were uploaded to repositories such as PyPI and GitHub, disguised as legitimate tools to gain developer trust.

These attacks allowed adversaries to introduce vulnerabilities into production systems during routine updates, without direct access to the target institution.

7. Vulnerability Exploitation Has Become Time-Critical

• The average time from vulnerability disclosure to exploitation has dropped to under 8 days, with some exploits observed within a few hours of public release.
• The report notes a 180% increase in incidents involving known vulnerabilities, particularly those affecting internet-facing applications and services.

8. Attacks Are Now Systemic, Interlinked, And Often Undetected

Modern cyberattacks no longer rely on a single point of failure. They are orchestrated across:

• Cloud misconfigurations (e.g., S3 exposure),
• Insider manipulation (e.g., of dormant accounts and card systems),
• APIs with BOLA flaws, and
• Phishing via AI-generated content.

Each vector reinforces the next. In several cases, the attackers moved laterally from one subsystem to another, remaining undetected for extended periods, at times over two years, as in the insider threat case cited in the report.

The Rise Of Social Engineering And Credential Theft

Social engineering, once the domain of crude phishing emails and low-effort impersonations, has become one of the most sophisticated and effective cyberattack strategies used against the BFSI sector. According to the report, its impact is now amplified by automation, AI-generated content, and deepfake technologies, turning what was once a manual con into a scalable, almost industrialised method of breach.

Social Engineering Is Now Personalised And Scalable

The report identifies Business Email Compromise (BEC) and phishing as the most persistent forms of social engineering in financial services:

• 54% of BEC incidents analysed involved some form of pretexting—that is, attackers creating plausible narratives to coax employees into taking action.
• These attacks are often backed by data scraped from social media, public records, or even prior breaches, allowing adversaries to mimic tone, internal language, and relationship dynamics.

The role of AI and Large Language Models (LLMs) is critical here. Attackers are now generating context-aware phishing messages that are grammatically correct, free of typographical cues, and virtually indistinguishable from legitimate internal communication.

Moreover, AI-generated phishing is no longer limited to email. The report cites a worrying rise in the use of NLP-driven chatbots deployed via SMS, social media, and browser-based applications. These chatbots simulate real customer service agents and extract information in real time, without the need for malware or code injection.

Deepfakes Have Moved From Novelty To Threat

The convergence of social engineering with deepfake technology represents a substantial risk for the BFSI sector. The report details cases in which:

• Synthetic audio and video were used to impersonate executives, authorise fund transfers, or approve system access.
• “Deepfake-as-a-service” platforms made such attacks more accessible, reducing the technical barrier for cybercriminals.
• MFA protections were bypassed not through code, but by convincing a human to approve a fraudulent request, based on a realistic video or voice prompt.

Credential Theft: Still Central, But Smarter

Credential theft continues to be a key enabler of more complex attacks. The report outlines three primary sources:

1. Phishing, enhanced by AI and social engineering
2. Information-stealing malware, often distributed via seemingly benign documents
3. Dark web marketplaces, where stolen credentials are sold or traded

Once obtained, these credentials are used to access:

• Single Sign-On (SSO) platforms
• VPNs
• Email accounts
• SaaS applications
• Internal admin dashboards

A recurring issue flagged in the report is the lack of session control and token invalidation. Many systems allow sessions to persist even after logout or inactivity, making them vulnerable to token theft and reuse.

The report also details how SaaS applications often include customer-specific information in URLs, which, when paired with valid session cookies, gives attackers unfettered access to highly sensitive data, without triggering any alerts.

Multi-Factor Authentication Is Being Circumvented

While MFA adoption has grown, attackers have adapted accordingly. Common techniques now include:

• Session hijacking: Stealing cookies or tokens to bypass the need for real-time authentication
• Push notification fatigue: Bombarding users with repeated MFA prompts until they approve one out of frustration
• Deepfake impersonation: Tricking users into handing over OTPs or approvals based on fake authority figures
• Broken Object-Level Authorisation (BOLA): Exploiting flaws in how APIs validate user roles, often enabling bypasses of OTP flows entirely

In one documented case, attackers used BOLA to access an OTP-protected endpoint on a payments platform, rendering the OTP process effectively meaningless.

Tactics Are Evolving Faster Than Controls

The report makes it clear: defensive strategies based on known tactics are no longer sufficient. The line between technical breach and psychological manipulation is now blurred. Attacks increasingly combine:

• Technical vulnerabilities (e.g., cloud misconfigurations),
• Behavioural exploitation (e.g., urgency emails from fake CEOs), and
• Credential reuse or session replay techniques

The implication for financial institutions is twofold: first, they must monitor who is accessing systems just as closely as what is being accessed. Second, they must anticipate that some attacks will look entirely legitimate at the surface level.

AI As An Enabler And Exploiter

Artificial Intelligence has become a tool of contradiction in cybersecurity—empowering defenders while simultaneously equipping attackers with speed, precision, and scale previously out of reach. What emerges in the Digital Threat Report 2024 is not just concern about AI’s misuse, but clear evidence of how it’s already being exploited in live incidents—some targeting high-trust systems within India’s BFSI sector.

For banks, insurers, fintechs and their customers, this dual use of AI means two things: the line between genuine and malicious interaction is fading, and the time window to detect deception is narrowing.

AI Is Being Used To Bypass Traditional Security Layers—Not Just Humans

While much attention has been paid to AI-generated phishing emails, the report highlights a more technical and immediate threat: AI-generated code that exploits cloud, API, and application vulnerabilities in real-time.

• The rise of LLM-assisted vulnerability discovery has allowed attackers to scan large codebases and uncover exploitable endpoints faster than ever before.
• Tools such as FraudGPT and WormGPT are now trained specifically on software documentation and vulnerability databases like CVE and OWASP, helping attackers generate tailor-made payloads against exposed infrastructure.
• These models are even capable of modifying exploit scripts on the fly based on target environment responses, replicating what once took hours of manual testing.

For customers, this means that attacks now require less reconnaissance and less trial-and-error. A small oversight—an outdated web application firewall, or a misconfigured API—can now be exploited at scale using a few lines of automated LLM-generated logic.

Threat Actors Are Training AI On Organisational Structures

One of the more subtle, but significant developments outlined in the report is that attackers are increasingly feeding AI systems with organisational metadata to model trust relationships and simulate internal authority.

• Public data from LinkedIn, Glassdoor, company websites, and press releases is being used to construct synthetic internal maps of organisations.
• These are then used to inform phishing campaigns, fake escalations, or impersonation attempts that mirror actual chains of command.
• In one reported incident, attackers impersonated an AVP in a lending institution using accurate job history and internal jargon gathered from social data and insider leaks. The deception wasn’t flagged for three days.

Model Poisoning And AI-Driven Surveillance Are Underestimated Risks

The report flags the emerging threat of AI model poisoning, particularly in BFSI environments where machine learning is increasingly used to detect fraud or assess creditworthiness.

• Adversaries are actively testing the limits of feedback loops in ML systems—injecting false behavioural signals to train fraud detection models into underestimating real risk.
• In open feedback environments (e.g., customer sentiment models, behavioural risk engines), a well-orchestrated campaign could allow malicious inputs to bias the model toward false negatives.
• The report draws attention to this in the context of AI-based onboarding systems and alternative credit scoring platforms, where model trust is silently eroded over time.

For customers, this means decisions about loan approval, account flags, or fraud alerts could be quietly manipulated, without either side being immediately aware.

Synthetic Identity Generation Is Being Used To Open Fraudulent Accounts

The report draws attention to a growing phenomenon: synthetic identity fraud powered by AI tools that assemble highly plausible—but entirely fictitious—digital identities.

• These identities are built using publicly available datasets (e.g. Aadhaar data leaks, voter records, dark web dumps) and filled out with fabricated personal histories, fake biometric data, and AI-generated photographs.
• Using these, attackers are able to pass eKYC checks, generate credit activity, and even obtain legitimate documents from secondary authorities before disappearing entirely.
• These accounts are then used for laundering money, accessing promotional credit products, or acting as mule accounts in broader fraud schemes.

Customers are often unaware that their compromised details are being used as “fragments” in synthetic identity creation, especially in rural or semi-urban segments where digital trail verification is less stringent.

AI Is Accelerating Financial Infrastructure Mapping For Targeted Breaches

Finally, the report documents how attackers are deploying AI to build real-time maps of institutional digital infrastructure—essentially creating a virtual blueprint of how a bank or insurer’s tech stack is laid out.

• By scanning headers, DNS data, TLS certificates, public code repositories, and employee tech blogs, threat actors can build detailed models of what software is deployed where, and what its likely vulnerabilities are.
• These AI-driven scans are run continuously, with results compared over time to detect changes in infrastructure posture, opening the door for just-in-time attacks after patch rollbacks, migrations, or product launches.

This kind of digital surveillance, automated and persistent, means that even minor updates can attract immediate attacker attention, especially in institutions that fail to update WAF rules or reconfigure access controls after change deployments.

Takeaway For Institutions And Customers Alike

AI is no longer a theoretical disruptor in cybersecurity. It is already being weaponised across the attack lifecycle: discovery, deception, exploitation, persistence, and evasion.

For institutions, this means re-evaluating what “real-time defence” actually looks like. For customers, it means being aware that not all fraud starts with negligence—some now begin with a perfect replica of your digital footprint, constructed by systems designed to deceive.

Supply Chain Attacks And Third-Party Risks

For years, cybersecurity strategies in BFSI have focused on perimeter control—keeping external threats at bay. But as financial institutions adopt cloud-native tools, outsourced operations, embedded finance APIs, and open banking frameworks, the perimeter has shifted. It now extends across a vast, interconnected network of vendors, processors, code libraries, and software dependencies.

According to the report, this extended chain of trust has become one of the most actively exploited attack vectors—not because of its visibility, but precisely because of its invisibility.

Trusted Software Is Now A Vector For Silent Breach

The report flags multiple high-profile examples of compromised third-party tools resulting in widespread exposure:

• The MOVEit Transfer breach, orchestrated by the CL0P ransomware group, affected several Indian BFSI entities indirectly via vendors that relied on the vulnerable file transfer utility.
• Similarly, GoAnywhere MFT, another widely deployed managed file transfer solution, was exploited in early 2024 to steal sensitive records from downstream BFSI service providers.
• In both cases, the exploit chain did not originate inside the financial institutions themselves. Instead, it passed through trusted service providers handling data movement or regulatory reporting.

Open Source Is Ubiquitous, But Rarely Audited

The report issues a pointed warning about open-source software in financial applications:

• Code libraries like XZ Utils, compromised in early 2024 via a backdoor planted in a widely used Linux compression package, serve as a reminder that even core infrastructure is not immune to manipulation.
• Developers working within BFSI projects often pull libraries from public repositories (e.g., GitHub, PyPI) without verifying integrity or digital signatures.
• The XZ attack was particularly dangerous because the backdoor was introduced by a trusted contributor over the course of multiple commits across two years, highlighting the patience and planning behind supply chain operations.

This creates a dual risk: institutions unknowingly deploy tainted code into production systems, and attackers exploit that code only after it’s deeply embedded in the transaction pipeline.

API Aggregators And Embedded Finance Platforms Are Emerging Risks

India’s fintech ecosystem is increasingly reliant on API aggregators, account aggregators, and KYC processors—many of which have direct access to user data, payment tokens, or transaction approval mechanisms.

The report identifies risks stemming from:

• Poorly secured API gateways, where misconfigured authentication policies allow unauthorised access to sensitive data or functionality.
• Inconsistent patching policies across vendors are leaving outdated components in production environments.
• Insufficient audit trails make it difficult to attribute unusual behaviour to a specific vendor action.

In one case study, a third-party identity verification platform, integrated via API with a digital NBFC, was exploited using a token replay technique that allowed attackers to submit stale authentication tokens and complete KYC checks under false identities.

Vendor Risk Management Is Often Superficial

While most BFSI organisations have vendor onboarding and audit frameworks, the report points to gaps in enforcement, frequency, and scope:

• Security questionnaires are often generic and self-attested, with little verification.
• Annual audits are insufficient in fast-evolving attack environments, especially when codebases and access controls change weekly.
• Many firms lack visibility into fourth-party dependencies—vendors of vendors—who may hold system-level access or process sensitive customer information.

The challenge, as the report outlines, is not merely identifying risk, but quantifying it and aligning it to real business impact.

Consequences For Customers: Silent Exposure

From a customer’s standpoint, these breaches are largely invisible until it’s too late. Sensitive data may be accessed, accounts manipulated, or transactions interfered with, without any breach occurring within the customer’s bank itself.

This decoupling of compromise from immediate visibility makes response slower and trust erosion harder to contain. Moreover, customers have no visibility into which third-party tools their financial service provider uses, or how rigorously they’re monitored.

Recommendations Emphasised In The Report

The Digital Threat Report offers a few key directives for BFSI firms:

• Implement Software Bill of Materials (SBOM) for all production dependencies
• Establish continuous vendor monitoring, not just point-in-time audits
• Require code integrity checks and digital signing for third-party libraries
• Ensure zero-trust policies extend to vendors and API partners
• Classify third-party services based on data access and enforce differentiated risk controls

Sectoral Defence – Observations Across Layers

Through a series of simulated attacks, incident response reviews, and forensic audits, the report reveals how security controls are implemented in reality, not how they are written in policy.

Application Security

Despite sector-wide adoption of microservices and API-first architecture, application-layer security remains patchy. The report highlights that authorisation logic is often enforced at the user interface level but inconsistently applied at the API layer, creating exploitable gaps in back-end enforcement. Several banking and lending applications exposed sensitive data such as PAN numbers, contact information, or KYC metadata through unsecured endpoints.

In many instances, encryption was either absent or poorly implemented. Sensitive user inputs—particularly those related to verification steps—were not consistently masked in transit. The most common oversight was the exposure of internal API keys or session tokens in front-end code, which allowed attackers to replay requests or modify session variables during testing.

Identity And Access Control

Control over digital identities, especially internal roles and service accounts, continues to be a weak link. The report finds repeated use of over-permissioned roles, including admin-level access granted to test accounts and expired vendors. In several simulated intrusions, red teams were able to gain persistent access via dormant accounts that had not been deactivated after a contractor’s exit.

Session management policies, while defined in internal documentation, were rarely enforced rigorously. Attackers exploited long-lived tokens, reused credentials between UAT and production environments, and, in some cases, leveraged a lack of session invalidation after logout to persist across application layers. Multi-factor authentication, though present on public-facing platforms, was notably absent from internal admin portals and dashboards, exposing a major surface of attack.

Cloud And DevSecOps Exposure

The report is especially critical of cloud deployment hygiene. While most BFSI firms had moved to hybrid or multi-cloud infrastructure, many had failed to configure storage and compute permissions correctly. Common findings included publicly accessible S3 buckets, unencrypted backups, and secrets hardcoded into deployment scripts.

DevOps practices often lag behind the security expectations placed on live infrastructure. CI/CD pipelines, which should act as security gatekeepers, were often configured without runtime testing for vulnerabilities. More concerningly, most institutions had no automated enforcement of security policy at the code commit level, leaving misconfigured infrastructure-as-code (IaC) files to propagate into production.

Network Segmentation And Monitoring

In terms of network architecture, the report notes a reliance on traditional perimeter security without adequate internal segmentation. In the event of a breach, attackers were often able to move laterally across environments with minimal resistance. Logs, where available, were typically fragmented between identity systems, cloud platforms, and network firewalls, making effective correlation and detection difficult.

More worryingly, in many real-world breach investigations, alerts were raised by SIEM or IDS systems but not acted upon, largely due to alert fatigue, unclear ownership, or lack of training among operational teams.

Governance And Operational Response

Perhaps the most concerning set of findings relates to governance. Incident response playbooks, where they existed, were often out of date, static, and not tailored to digital operations. Roles and escalation paths were unclear, and in several engagements, it was found that security operations centres (SOCs) escalated alerts to business teams with no defined protocol on how to respond.

Furthermore, third-party systems were frequently onboarded without structured risk reviews or technical integration audits. KYC vendors, payment aggregators, or CRM providers were often trusted by default, even when embedded deep within transaction workflows. The absence of real-time risk scoring or behavioural monitoring meant that suspicious activity through third-party integrations went unnoticed.

Regulatory Directions And Gaps

In recent years, India’s regulatory landscape has undergone a profound shift. Where compliance was once treated as a periodic obligation—an annual exercise in box-ticking—it has now evolved into a core operational function within financial services. The Digital Threat Report 2024 recognises this transformation, but also highlights the growing complexity that institutions must navigate as regulators, jurisdictions, and international frameworks overlap in unpredictable ways.

A Dense Thicket Of Regulatory Mandates

The regulatory ecosystem in India is described in the report as “rapidly evolving”—a polite way of saying labyrinthine. Financial entities today must adhere to a range of directives, including:

• CERT-In’s six-hour breach reporting mandate, which compels institutions to disclose incidents swiftly, sometimes before investigations have even stabilised.
• RBI’s Master Directions on Digital Payment Security Controls (DPSC) and Outsourcing of IT Services, placing stringent controls on authentication, data encryption, and vendor oversight.
• The Cyber Security Framework (CSF) for banks establishes baseline security standards but requires individual interpretation.
• SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF), targeted at stock exchanges and depositories.
• IRDAI’s Information and Cybersecurity Guidelines, built specifically for insurers.
• The Digital Personal Data Protection (DPDP) Act, 2023, adds statutory backing to consent, storage limitation, and purpose limitation principles.
• PCI DSS 4.0, GDPR, and CCPA for globally operating BFSI firms.

Each framework represents a good-faith effort to modernise cybersecurity in its domain. But taken together, they form a fractured compliance mosaic, particularly burdensome for fintechs and conglomerates operating across sectors and geographies.

Compliance Fatigue: The Cost Of Fragmentation

Institutions face regulatory duplication, contradictory obligations, and significant operational drag in managing audits, controls, and documentation. The lack of a unified cybersecurity framework leads to redundant risk assessments, overlapping breach reports, and inconsistent technical standards across lines of business.

In cross-border payment systems, where transaction speed and precision are non-negotiable, these inefficiencies have real implications. The inconsistencies slow down decision-making, complicate threat response, and increase the cost of staying compliant without necessarily reducing risk.

Compliance-As-Innovation

What’s more encouraging, however, is the emergence of a design-forward approach to compliance. The report spotlights financial organisations that are embedding compliance protocols at the product development stage, rather than retrofitting them after launch.

This includes the use of:

• Data anonymisation and synthetic datasets to train fraud models without compromising real customer data.
• Privacy-by-design principles, where customer consent, data minimisation, and access restrictions are built into application architecture.
• Security-by-default configurations—especially for API endpoints, transaction logging, and cloud storage platforms.

Such moves are not only cost-effective but also position these institutions for faster scaling, fewer audit frictions, and improved stakeholder trust.

The Push For Harmonisation

Despite the regulatory sprawl, the report observes growing consensus across regulators to pursue harmonised standards. RBI, SEBI, and IRDAI are increasingly aligned in their understanding of sectoral risks, and organisations such as CERT-In and CSIRT-Fin are now acting as connective tissue, providing not just guidance but strategic coordination across response frameworks, threat intelligence dissemination, and testing protocols.

The momentum is clearly towards cohesive regulation, not just to reduce compliance fatigue, but to foster a uniform standard of resilience across India’s BFSI ecosystem.

Regulatory Gaps That Demand Urgent Attention

Yet, the report does not gloss over where gaps remain. These include:

• Lack of universal standards across digital payment systems—wallets, UPI, QR codes, and embedded finance products still operate under inconsistent security norms.
• Absence of formal response mandates like red-teaming or breach simulations, which are vital in testing real-world resilience.
• No regulatory guidance on AI-generated threats, such as impersonation fraud via deepfakes or LLM-manipulated phishing tools.
• Underpowered cyber leadership, with CISOs often lacking the organisational clout to enforce security policy independently from CIOs or CTOs.
• No roadmap yet for post-quantum cryptography, despite warnings that public key infrastructure may not withstand future computational models.

These aren’t merely procedural shortcomings. They represent strategic vulnerabilities in an environment where adversaries are increasingly faster and better funded than their targets.

Actionable Recommendations

The report outlines six concrete suggestions to bridge these gaps:

1. Treat cybersecurity as a techno-commercial function—not an IT silo—with direct reporting to CEOs or Chief Risk Officers.
2. Standardise digital payment security across form factors, ensuring that UPI, wallets, and cards are treated with parity.
3. Accelerate preparation for quantum threats, including migration strategies and testing protocols.
4. Incentivise certification programmes to create a skilled pool of payment security specialists.
5. Mandate regular incident simulations to uncover hidden failure points before attackers do.
6. Draft a Responsible AI framework for BFSI, focusing not only on fairness and accuracy but misuse and weaponisation risks​.

Cybersecurity In 2025: What Lies Ahead?

While the core threats are called out explicitly in the report, the full breadth of its findings—spanning observed breach patterns, adversary tactics, and forensic insights—adds texture and urgency to this outlook.

1. Deepfake Identity Fraud Will Scale Executive Impersonation

Voice cloning, synthetic avatars, and video forgeries are no longer fringe experiments. The report cites widespread adoption of deepfake technology for corporate impersonation, where attackers use hyperrealistic voice or video to impersonate a CFO or CEO in real-time, often during virtual calls or messaging threads. OTP phishing, fund diversion, and executive-level BEC scams are the most common payloads​.

2. Supply Chain Attacks Will Target The Software Backbone

Third-party integrations are a silent risk. The report illustrates how malicious libraries—often disguised as legitimate open-source components—can slip into core banking systems, digital apps, or APIs. These are particularly hard to detect because they arrive via trusted vendors or routine updates. Notably, cases like the MOVEit and GoAnywhere breaches are referenced to highlight the risks of managed file transfer services​.

3. IoT Devices Will Become Prime Infiltration Points

Financial systems are increasingly dependent on kiosks, smart safes, biometric devices, and surveillance hardware. Many of these are underpatched, poorly segmented, or operate on outdated firmware. Once breached, they become pivot points into sensitive systems or customer data environments​.

4. Prompt Injection And Local LLM Exploits Will Rise Sharply

With financial institutions exploring AI-native interfaces—from chatbots to document reviewers—the risk of prompt injection attacks is growing. Locally hosted LLMs (as opposed to cloud-based models) are particularly vulnerable to input manipulation that causes data leaks, policy bypass, or dangerous automated outputs​.

5. Adversarial LLMs Will Democratise Sophisticated Cyber Offence

WormGPT, FraudGPT, WolfGPT—these maliciously trained LLMs are enabling a new class of attackers to generate polymorphic malware, phishing templates, exploit kits, and social engineering scripts at scale. Crucially, these tools can mutate to evade detection and are already being sold on dark web forums​.

6. Cryptocurrencies Will Remain Both Target And Tool

The report details how attackers are shifting focus from exchanges to crypto wallets, smart contracts, and custodial platforms. These assets offer anonymity, immutability, and fast monetisation, making them ideal for laundering and extortion, particularly in ransomware or data-theft scenarios​.

7. Quantum Computing Could Break Today’s Encryption

Although quantum threats are still theoretical in 2024, the report flags them as urgent for financial systems reliant on RSA or ECC encryption. The lack of a national migration plan for post-quantum cryptography puts high-value data, like account credentials or transaction logs, at long-term risk​.

8. Zero-Day Exploits And Patch Lag Will Widen Risk Windows

A key statistic: the average time to exploit a disclosed vulnerability is now eight days. Many BFSI entities still operate without continuous scanning, automated patching, or VAPT cycles frequent enough to match the pace of exposure. Zero-day exploits remain a preferred point of entry​.

9. API Abuse Will Bypass Perimeter Controls

From mobile wallets to third-party payment apps, weak API authentication—hardcoded keys, predictable naming schemes, credential reuse—remains one of the most abused vulnerabilities. These weaknesses are especially dangerous because they are public-facing and linked directly to money movement​.

10. Cloud Misconfigurations Will Continue To Leak Sensitive Data

Cloud buckets left open, IAM roles overly permissive, or critical logs not ingested by SIEMs—these are not hypothetical flaws. The report outlines repeated examples of data breaches due to poor cloud hygiene. The rapid pace of cloud adoption is outstripping the pace of secure configuration in most firms​.

11. Business Email Compromise (BEC) Will Become AI-Powered

AI models can now write perfect emails in multiple languages and spoof tone and formatting. This makes phishing more convincing and harder to detect. The report notes that in over 54% of BEC cases, attackers used pretexting with stolen session data, OTP interception, or AI-generated content​.

12. Multifactor Authentication Will Not Be Enough

MFA, once considered the gold standard, is now regularly bypassed. Methods include session hijacking, push fatigue attacks, deepfake OTP theft, and vulnerabilities like BOLA (Broken Object Level Authentication). Many financial institutions are only now revisiting their MFA implementations in light of these methods​.

13. Ransomware Will Shift To Data Extortion Models

Rather than encrypting data and demanding decryption keys, newer ransomware groups are focusing on exfiltration and extortion, threatening to leak sensitive financial data unless payment is made. This tactic has proven more lucrative and harder to neutralise with backups alone​.

14. Social Engineering Will Converge With Insider Threats

The report also references external actors compromising employees via social engineering, bribery, or deception. In some incidents (including outside India), administrators were persuaded via cryptocurrency incentives to alter settings or disable controls. This marks a concerning convergence of human error and intentional sabotage​.

From Vulnerable To Vigilant: Building Cyber Resilience That Lasts

If the Digital Threat Report 2024 delivers one message with clarity, it’s this: today’s threats will not be stopped by yesterday’s defences. And yet, most financial institutions still rely on security measures built for an earlier time, when threats were linear, insider-driven, and human-scaled.

The new cyber landscape is asymmetrical, faster than before, and often machine-led. Resilience, then, is no longer about plugging holes. It’s about building systems—across people, processes, and infrastructure—that can withstand pressure without collapse.

Investing In People Who Understand The Stakes

Cybersecurity training still exists in most institutions—but it’s often too rare, too broad, and too dull. The report makes a sharp point: staff don’t need longer e-learning videos. They need short, frequent, role-specific training that reflects the threats they are most likely to face.

In today’s environment, that includes recognising deepfakes, spotting QR-code traps, and understanding how AI can spoof tone, identity, and legitimacy. This is especially important for executives and finance teams, who remain prime targets for BEC (Business Email Compromise) and authorisation fraud.

Just as critically, the report calls out the governance gap. It’s not enough to have a CISO buried under the CIO. Cybersecurity must report into risk leadership or directly to the CEO, not because of hierarchy, but because that’s where real decisions get made.

What to do:

• Drop the once-a-year training model. Move to quarterly, threat-specific refreshers.
• Equip executives with deepfake and AI-scam awareness, especially around authorisation flows.
• Ensure cyber risk leadership sits at board level, not just IT or infrastructure.

Fixing The Framework

Good security frameworks often look solid on slides. But the moment a breach occurs, clarity disappears. Who responds first? Who decides if law enforcement is involved? What happens if customer data is affected? And how soon does reporting need to happen?

According to the report, most institutions still don’t run simulation drills to answer these questions under stress. And in several major incidents reviewed, the response plan wasn’t followed, because no one had rehearsed it.

It’s not just response plans that need work. Vulnerability management remains too slow. Patching cycles are still monthly, when most critical exploits go live in under eight days. In the age of adversarial AI, even a fortnight’s delay can be fatal.

What to do:

• Run regular breach simulation exercises, not just tabletop exercises.
• Shorten patching cycles. For high-severity CVEs, aim for under a week, not a month.
• Align cyber process ownership across functions—not just IT, but fraud, compliance, and legal.

Smarter Technology: Tools That Predict, Not Just Detect

The report doesn’t push for more technology. It argues for smarter, integrated technology tools that work together, flag anomalies in context, and allow for automation when response time is everything.

In particular, it points to AI-based monitoring systems capable of identifying behavioural deviations in real time, autonomous patching, and identity-based access controls that remove blanket permissions and reduce lateral movement.

It also warns against blind spots in mobile-first and cloud-first environments. Many firms still fail to monitor API traffic, still leave cloud storage buckets exposed, and still treat service-to-service traffic as trusted. That trust, the report says, is being weaponised.

What to do:

• Adopt Zero Trust Architecture, not just in theory but in traffic flows.
• Monitor API and service-layer logs, not just endpoint devices.
• Transition to adaptive access control—permissions that expire or adjust with behaviour, not just login state.
• Bake security into DevOps pipelines. Automated checks at code commit and deployment can catch what manual review misses.

Conclusion

The Digital Threat Report 2024 leaves little room for complacency. From AI-driven fraud to deepfake impersonation, from supply chain intrusions to regulatory fragmentation, the risks are escalating in both speed and sophistication. But the message isn’t fatalistic—it’s instructive. Institutions that treat cybersecurity as an operational benchmark, not a compliance obligation, will be best positioned to withstand what’s coming. Resilience isn’t just a matter of controls; it’s a mindset, rooted in clarity, accountability, and constant rehearsal.