Bank-Grade Threats, NBFC-Sized Teams

31 October 2026 · 8 min read

On this page

Small teams, bank-grade threats
Your vendor is your perimeter
Passing the audit is not the same as being secure
What a breach could cost a mid-sized NBFC
Finding risks is easy. Connecting them is the hard part.
What consolidation should actually mean
Five questions for your next risk committee
Where this is heading
The goal is fewer surprises, not more dashboards

Bank-Grade Threats, NBFC-Sized Teams

Why mid-sized NBFCs need a different cybersecurity strategy

By Nikunj Mathur, Founder & CEO, Foresee Security

On the morning of 19 October 2026, attackers got into a Hyderabad NBFC's systems and API infrastructure and moved more than ₹3.3 crore out in 87 minutes: 183 unauthorised transactions to 52 accounts. The company's CFO filed a police complaint the next day. About ₹40 lakh was frozen. The rest was gone. (RMA India)

It wasn't an isolated case. Ten days earlier, CERT-In had warned NBFCs, digital lenders and payment providers about attacks on payment and disbursement APIs used to make unauthorised transfers. The Economic Times has since reported that smaller NBFCs, with turnover of around ₹1,000 crore or less, lost about ₹300 crore to such attacks in roughly two months, according to MediaNama's summary. Neither RBI nor CERT-In has confirmed that figure, and the affected lenders haven't been named.

That is what cyber risk looks like for a mid-sized NBFC now. The money didn't leave through a hacked vault. It left through the API connections that link a lender to its payment gateways and partner banks, at machine speed, faster than a small team could notice.

Small teams, bank-grade threats

At most mid-sized NBFCs, one small security team owns everything: vulnerability management, vendor risk, RBI compliance, data protection, incident response and, more and more often, AI. At a large bank, each of those is a department. The strain shows. In Intruder's 2026 survey of 500 mid-market security leaders, including financial services and fintech firms, 42% described their teams as stretched, overwhelmed or consistently behind.

Attackers don't adjust for headcount. A loan app built by a 500-person NBFC holds the same kind of customer data as one built by a bank with 50,000 staff, and the bill for losing it is no smaller. IBM's 2026 Cost of a Data Breach report puts the average breach at an Indian financial services firm at ₹40.9 crore, the highest of any sector.

That gap between the threat and the team is the real story of NBFC security. Buying more tools hasn't closed it.

Your vendor is your perimeter

Third parties are now the pattern, not the exception. Verizon's 2025 Data Breach Investigations Report found a third party involved in 30% of breaches, double the year before. Yet most NBFCs still assess critical vendors once a year, usually by questionnaire.

The Salesloft Drift breach shows what that misses. Attackers were inside Salesloft's GitHub account from as early as March 2025. In August they used stolen Drift tokens to pull Salesforce data from more than 700 organisations, including Cloudflare, Zscaler and Palo Alto Networks. A customer that reviewed Salesloft in the spring would have seen a clean vendor that was already compromised.

RBI has noticed. Its 2025 outsourcing directions make clear that outsourcing doesn't dilute the NBFC's own accountability. Its July 2026 cybersecurity directions go further for base-layer NBFCs above ₹500 crore: outsourcing contracts must now provide for continuous monitoring and assessment of the service provider. An annual questionnaire doesn't meet that bar.

Passing the audit is not the same as being secure

Regulation moved again this year. On 31 July 2026, RBI issued its Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions for NBFCs, effective immediately and replacing the earlier NBFC IT framework and governance directions. Requirements scale by layer. Middle-layer NBFCs and above now need a CISO with no business targets, a quarterly cyber risk review before the board, vulnerability assessments every six months and penetration tests every year on critical systems. Cyber incidents must reach RBI within six hours.

The DPDP Rules, notified in November 2025, add a second regulator. Most data fiduciary obligations phase in by May 2027, and the government has discussed bringing them forward for larger data handlers.

The trap is treating each of these as a calendar event. A six-monthly vulnerability assessment tests your exposure on two days a year. A staging server exposed the week after, or a vendor integration rushed in before a product launch, won't show up until the next cycle. The new directions themselves ask NBFCs to consider continuous auditing of critical systems. What boards need is evidence that controls still work between audits.

What a breach could cost a mid-sized NBFC

The numbers are no longer abstract, and they are rising.

Exposure	Figure	Source
Average breach cost, Indian financial services firm (2026)	₹40.9 crore	IBM, 2026
Average breach cost, all Indian organisations	₹25.5 crore in 2026, up from ₹22 crore in 2025	IBM, 2026
DPDP penalty: failure to take reasonable security safeguards	Up to ₹250 crore	DPDP Act, Schedule
DPDP penalty: failure to notify a breach	Up to ₹200 crore	DPDP Act, Schedule
Indian breaches that started with a supply chain compromise	15%	IBM, 2026

Put those together. A single vendor-caused breach could cost a mid-sized NBFC around ₹40 crore to clean up. Once DPDP obligations take full effect, the same incident could add a penalty of up to ₹250 crore if safeguards are found inadequate, and up to ₹200 crore more if the breach isn't reported properly. The NBFC stays accountable for personal data its vendors process on its behalf.

Finding risks is easy. Connecting them is the hard part.

Most NBFCs already own a vulnerability scanner, an endpoint tool, a SIEM and some kind of compliance tracker. IBM and Palo Alto Networks found that larger organisations juggle an average of 83 security solutions from 29 vendors. Mid-sized firms run fewer, but 45% of the mid-market leaders in Intruder's survey say they combine multiple tools just to cover gaps. Each tool produces findings, and none of them talks to the others.

So the scanner flags a critical flaw on an internet-facing lending API. Separately, the vendor that built that API slips on its security posture. Separately again, the auditor notes that access reviews on the same system are overdue. That's three findings, three owners and three priority queues. Together they describe one serious, exploitable risk to the core lending business.

A small team cannot join those dots by hand. A record 48,185 CVEs were published in 2025, about 131 a day, and nearly 40% of them were rated high or critical. Half the mid-market leaders Intruder surveyed said assessing their exposure to a single critical zero-day would take about a week. Large banks solve this with headcount. Mid-sized NBFCs have to solve it with better plumbing.

What consolidation should actually mean

Vendors, us included, are fond of the word “platformization.” It's worth being precise about what it can and can't do for an NBFC.

It won't replace your firewall, EDR, identity stack or SIEM. Those stay, and anyone telling a CISO otherwise is overselling.

What can sensibly be consolidated is the layer above them: external attack surface monitoring, third-party risk, compliance evidence and risk reporting. NBFCs often buy these as four separate products, each with its own licence, onboarding and dashboard. All four work on the same assets, the same vendors and the same controls. Running them as one system is where a small team gets its time back, and where findings finally get linked to each other.

The automation case has a number behind it now. In IBM's 2026 India data, organisations with no AI or automation in security operations paid ₹31.6 crore per breach on average, against ₹21.3 crore for those using it extensively.

Fewer consoles also means fewer integrations to secure. After a year in which one chatbot integration exposed 700 organisations, that is a security argument as much as a cost one.

Five questions for your next risk committee

Could we list every internet-facing asset we own today? How did we learn about the last one we didn't know existed?
Which of our critical vendors had a security incident or posture change in the last 90 days, and how would we have found out?
Can we show the regulator that a key control worked last month, not only on audit day?
Do we know which systems and vendors hold customer personal data, ahead of the DPDP deadline?
Can we name our top five cyber risks in business terms: which product, which customers, how much downtime?

If any answer takes more than a day to put together, start there.

Where this is heading

Four trends point the same way over the next two years.

Balance sheets are growing faster than security teams. Crisil Ratings expects NBFC assets under management to grow 18–19% a year and cross ₹50 lakh crore by March 2027. More loans mean more customer data, more vendors and more integrations to watch.

Attackers are using AI. IBM found that 26% of malicious breaches in India in 2026 were AI-generated. Faster, cheaper attacks favour the attacker against a small team working through findings by hand.

Spending is shifting to outside help. Gartner expects Indian information security spending to reach $3.4 billion in 2026, up 11.7%, with managed security services the fastest-growing segment at 15.1%. Organisations that can't hire fast enough are buying capacity instead.

The compliance clock is running. RBI's 2026 directions are already in force, and DPDP data fiduciary obligations apply from May 2027, possibly sooner for larger players. Boards will be asked for evidence, not intentions.

The NBFCs that come through this well won't be the ones with the most tools. They'll be the ones that can see their exposure, including their vendors' exposure, all the time.

The goal is fewer surprises, not more dashboards

None of this requires an NBFC to build a bank-sized security function. It requires knowing which handful of risks could actually hurt the business, and seeing them before they become incidents.

That's the problem we're working on at Foresee Security. If you lead security or risk at an NBFC and are working through the same questions, I'd like to compare notes.

Nikunj Mathur is Founder & CEO of Foresee Security, a cyber risk intelligence platform.