SEBICSCRFAI advisoryAttack Surface ManagementIndiaCTEM
7 views

SEBI CSCRF and the 2026 AI Vulnerability Advisory: An External Exposure Checklist for Regulated Entities

By Heeraj NairPublished
SEBI CSCRF external exposure checklist: SEBI checks the outside, check it first
In May 2026, SEBI told regulated entities across India's securities market that AI tools can now find and exploit existing vulnerabilities "using speed and scale". It named Claude Mythos as an example, set up a task force, and told regulated entities to read the advisory with the framework they already follow: the Cybersecurity and Cyber Resilience Framework, or CSCRF.
The advisory didn't add a new rulebook. It raised the cost of ignoring the old one.
That is the short answer. The rest of this post covers who CSCRF applies to, what the AI advisory says, how CSCRF maps to external exposure checks, and a checklist for brokers, AMCs, depositories, exchanges, RTAs, KRAs and their MSSPs.

Key findings

  • CSCRF sorts regulated entities (REs) into five categories: MIIs, Qualified REs, Mid-size, Small-size and Self-certification REs. SEBI moved KRAs from MIIs to Qualified REs in April 2025.
  • After two extensions, the last deadline was 31 August 2025 (MIIs, KRAs and QRTAs were excluded). CSCRF is in force.
  • CSCRF's critical systems include "Internet facing applications/ systems" and "Client facing application/ systems". Your external attack surface is in scope by definition.
  • Asset changes must reach the inventory within 3 working days, including digital assets "such as URLs, domain names, application, APIs".
  • SEBI's 5 May 2026 AI advisory asks for immediate patching, an API inventory and "regular/continuous" vulnerability assessment.

What is SEBI CSCRF, and who does it apply to?

The Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities was issued by circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 on 20 August 2024 (SEBI). MIIs and Qualified REs carry the heaviest load. Self-certification REs need only a VAPT audit by a CERT-In empanelled auditor, plus a signed self-certification of compliance.
SEBI has adjusted the framework since. Circular 2025/60 of 30 April 2025 revised categorisation thresholds, moved KRAs to Qualified REs, and fixed each RE's category at the start of the financial year based on the previous year's data (SEBI). Circular 2025/119 of 28 August 2025 issued technical clarifications (SEBI). It includes a principle of equivalence for REs with another primary regulator, such as banks acting as custodians or DPs. For the RBI side, see our RBI cyber resilience and CTEM guide.

When did CSCRF compliance become mandatory?

The original glide path was 1 January 2025 for the six RE categories that already had a SEBI cyber security circular, and 1 April 2025 for REs covered for the first time.
Circular 2025/45 of 28 March 2025 extended this to 30 June 2025. Circular 2025/96 of 30 June 2025 extended it again, to 31 August 2025 (SEBI). Both excluded MIIs, KRAs and Qualified RTAs (QRTAs), which kept the original timelines.
Every deadline has passed. What matters now is your next VAPT and cyber audit.

What does SEBI's May 2026 AI vulnerability advisory say?

On 5 May 2026, SEBI issued an Advisory on Emerging Advanced Artificial Intelligence (AI) Tools for Vulnerability Detection (like Mythos), circular HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026. It is addressed to regulated entities including stock exchanges, depositories, clearing corporations, brokers, AMCs, RTAs and KRAs (SEBI).
SEBI's concern is speed: such tools "may give rise to heightened risk exposure by enabling identification and potential exploitation of existing vulnerabilities using speed and scale". To prevent "a cascading impact" across interconnected market participants, it set up a task force, cyber-suraksha.ai, to devise a uniform mitigation strategy, share threat intelligence and playbooks, report incidents and vulnerabilities on a priority basis, and review third-party application providers, including empanelled vendors.
The advisory's Annexure-A lists ten measures. Those with the most outside-in weight:
  1. Patch operating systems and applications "on immediate basis", with virtual patching where no patch exists.
  2. Run vulnerability assessment "using conventional and suitable AI based Vulnerability Assessment Tools where possible", and audits "on a regular/continuous basis" in line with CSCRF.
  3. Keep an inventory of all APIs and the applications using them, with strong authentication, rate limiting and whitelist-based connections.
  4. Disable unnecessary services and default accounts "to minimize the attack surface".
  5. Periodically update the asset inventory and software bill of materials for critical applications.
It also tells eligible REs to "expedite" Market SOC onboarding and to treat AI capability as a CSCRF risk scenario.

Which CSCRF requirements depend on external exposure?

More than most teams expect. The first two columns follow the framework; the last two are our reading.
CSCRF requirementApplies toExternal exposure checkHow to evidence it
Critical systems include internet-facing and client-facing systems (Definitions)All REsDiscover every internet-facing host, app and APIDiscovery output reconciled to the Board-approved critical systems list
Inventory digital assets "such as URLs, domain names, application, APIs"; changes within 3 working days (ID.AM.S1, ID.AM.S4)All REsContinuous discovery of new domains, subdomains, public IPs and cloud endpointsChange log showing each new asset inventoried within 3 working days
VAPT scope covers systems with public IPs and websites; VAPT before commissioning new systems (DE.CM.S5)All REsFind external assets missing from VAPT scopeScope list compared with discovery, gaps added
VAPT findings closed within 3 months, revalidated within 5 (Section 4.3)All REsRe-test closed findings from outside between cyclesDated evidence that closed findings stay closed
Monitor cyberspace for phishing websites using your domains; report to CSIRT-Fin/CERT-In (ID.RA.S4)All REsLookalike domain and phishing site detectionDetection records and reports filed
Dark web monitoring for brand abuse and data/credential leaks; takedowns; anti-phishing and anti-rogue app services (ID.RA.S3)MIIs, Qualified REsBreached credentials, stealer logs, rogue apps, fake profilesMonitoring reports and takedown records
CART "for continuous, automated process of testing the security of the systems, and achieving greater visibility on attack surfaces" (DE.DP.S4)MIIs, Qualified REsContinuous outside-in testing between half-yearly red team exercisesCART output alongside red team reports
In CSCRF, CART stands for Continuous Automated Red Teaming. The August 2025 clarifications turned a separate, general guideline to deploy "BAS, CART, decoy, vulnerability management" (DE.CM.S3) into a recommendation. Confirm with your auditor how that applies to your category.

How often does CSCRF require VAPT and cyber audits?

Under sections 4.3 and 4.4 of the framework:
  • VAPT: at least twice a year, one in each half of the financial year, for REs identified by NCIIPC as "Protected systems" or Critical Information Infrastructure. At least once a year for all others, starting in the first quarter.
  • VAPT timelines: report within 1 month of completion, findings closed within 3 months of the report, revalidation within 5 months.
  • Cyber audit: at least twice a year for MIIs, Qualified REs, and Mid-size and Small-size REs offering internet-based or algo trading; at least once a year for the rest. It covers 100% of critical systems and a 25% sample of the rest.
  • Auditors: a CERT-In empanelled IS auditing organisation, unless stated otherwise.
A yearly VAPT leaves months in which a new exposure goes untested. External monitoring fills that gap; it doesn't replace the test.

What does CSCRF expect from your SOC?

Every RE needs continuous monitoring through a SOC: its own, a group SOC, a third-party SOC or a Market SOC. NSE and BSE were mandated to set up Market SOCs, and Small-size and Self-certification REs must onboard to one, although SEBI's FAQs let those with their own SOC use it. MIIs must run a 24×7×365 SOC.
Incidents covered by CERT-In's directions must be notified to SEBI and CERT-In within 6 hours of noticing them or being told about them, with details on SEBI's incident portal within 24 hours. For the CERT-In side, see our CERT-In AI agents advisory checklist.
A SOC sees what reaches your logs, not the forgotten subdomain or credentials leaked on a forum.

The external exposure checklist for SEBI regulated entities

  1. Confirm your category for this financial year. It sets your obligations.
  2. Build the inventory from outside in. Discover domains, subdomains, public IPs, cloud assets and APIs, then reconcile with your CMDB and critical systems list.
  3. Meet the 3-working-day rule. Alert on new internet-facing assets so they reach the inventory in time.
  4. Close VAPT scope gaps. Anything discovery finds outside scope goes into the next test, or a test before commissioning.
  5. Patch what faces the internet first. The advisory says "immediate". Use virtual patching where no fix exists.
  6. Inventory and lock down APIs. Find old and undocumented endpoints; enforce authentication, rate limits and whitelisting.
  7. Retest closures from outside before formal revalidation.
  8. Watch for phishing and impersonation. Lookalike domains for every RE; rogue apps, fake profiles and takedowns where ID.RA.S3 applies.
  9. Monitor leaked credentials in breach data and stealer logs tied to your domains.
  10. Include vendors. The task force reviews third-party providers. Map their internet-facing exposure too.
MSSPs can run the same ten steps per client.

What most teams get wrong

  • Treating CSCRF as an annual audit. A 3-working-day inventory rule and "regular/continuous" assessment don't fit a yearly cycle.
  • Inventorying only what IT approved. Marketing microsites, vendor portals and test APIs are internet-facing systems too.
  • Scoping VAPT from the CMDB alone. If the CMDB misses assets, so does the VAPT.
  • Leaving phishing to the brand team. Phishing-site monitoring under ID.RA.S4 is mandatory for all REs.
  • Forgetting vendors. Your exposure includes theirs.

Key takeaways

  • SEBI CSCRF (20 August 2024) is in force; the last extension ran to 31 August 2025 for most REs.
  • Internet-facing and client-facing systems are critical systems, and digital assets must be inventoried within 3 working days of a change.
  • SEBI's 5 May 2026 AI advisory asks for immediate patching, API inventory and continuous vulnerability assessment, read with CSCRF.
  • External monitoring evidences several CSCRF requirements between formal tests.

Is your external exposure ready for a CSCRF audit?

Check these five things. You can answer each one from your own records this week.
  • ☐ Does your inventory include every domain, subdomain, public IP and API, and did the last new one get added within 3 working days?
  • ☐ Was everything internet-facing in scope for your last VAPT?
  • ☐ Can you show dated evidence that last cycle's closed findings are still closed?
  • ☐ Do you monitor for phishing sites using your domains, and report them to CSIRT-Fin or CERT-In?
  • ☐ Would you know this week if staff or client credentials tied to your domains appeared in a stealer log?

What ScruteX finds here

ScruteX (formerly BrandSek) looks at your organisation from the outside, the way an AI vulnerability tool would. External attack surface monitoring continuously discovers domains, subdomains, IPs, exposed services and cloud assets, and flags new assets and newly exposed ports. Vulnerability Insights checks each asset for weak certificates, dangling subdomains and outdated technologies, and (on Enterprise plans) runs daily active vulnerability scans of external IPs.
Data Exposure Insights monitors the dark, deep and surface web for breached credentials, infostealer logs, leaked sessions and source code exposure. Brand Insights detects lookalike domains, rogue mobile apps and fake social profiles, with takedown assistance on Enterprise plans. Threat Insights adds intelligence on ransomware groups, threat actors and CVEs. Enterprise customers can add Continuous Automated Red Teaming (CART).
Together they give you outside-in evidence for the table above. For one common gap, see exposed Swagger files, APIs and staging sites.

See your exposure the way an attacker does

Start with a free exposure scan. Agentless: a domain and a set of keywords. No credit card.
ScruteX sees only what is visible from outside your network. It is not a substitute for the CSCRF cyber audit, VAPT by a CERT-In empanelled auditor, your SOC, or legal advice on your obligations.

FAQ

Q: What is SEBI CSCRF?

A: The Cybersecurity and Cyber Resilience Framework (CSCRF) is SEBI's cyber security framework for regulated entities in India's securities market, issued by circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 on 20 August 2024. Obligations scale across five RE categories.

Q: What is the deadline for SEBI CSCRF compliance?

A: Originally 1 January 2025 or 1 April 2025, depending on the RE category. SEBI extended this to 30 June 2025, then 31 August 2025, for all REs except MIIs, KRAs and QRTAs.

Q: What does CART mean in SEBI CSCRF?

A: Continuous Automated Red Teaming. Guideline DE.DP.S4 for MIIs and Qualified REs says a CART solution shall be deployed for continuous, automated testing and "greater visibility on attack surfaces". The August 2025 clarifications made a separate general BAS/CART guideline a recommendation.

Q: How often must SEBI regulated entities run VAPT?

A: At least once a year, starting in the first quarter of the financial year. REs identified by NCIIPC as protected systems or Critical Information Infrastructure must run it twice, once in each half.

Q: What is SEBI's AI vulnerability detection advisory?

A: A SEBI circular of 5 May 2026 (HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026) warning that AI tools such as Claude Mythos can find and exploit vulnerabilities at speed and scale. It set up the cyber-suraksha.ai task force and lists ten measures, including immediate patching, API inventory and continuous vulnerability assessment.

Q: Does CSCRF apply to MSSPs?

A: Not directly; it applies to SEBI regulated entities. But SEBI's AI advisory puts third-party providers and empanelled vendors under task force review, so MSSPs should expect clients to ask for CSCRF-aligned evidence.

Sources

Back to all posts