Open data from BitScore
Three datasets, all free to use and free to quote. One tracks what Indian regulators have actually issued, one counts what is actually happening, and one measures how ready the financial sector is for what comes next.
Most numbers in Indian cyber security reporting cannot be checked. They arrive without a window, without a method, and without the underlying rows. These can be: each is published as a file, under a licence that lets you use it, with the rule that produced every value written down beside it.
All are free to use under CC BY 4.0. Attribution is the only condition — credit bitscore.in and link back to the dataset page.
Indian Cyber Regulation Register
Every cyber and data-protection instrument binding Indian regulated entities — reference, date, status, deadlines. Read at source; downloadable as JSON and CSV. 32 instruments from six regulators, each carrying its own reference number, its issue date, whether it is in force, any deadline it sets, and the date somebody last opened the regulator’s own notification to check. Last updated .
- Read the register — the full table, with the method and the source for every entry.
- india-cyber-regulations.json — one object per instrument, deadlines nested.
- india-cyber-regulations.csv — the same rows flattened for a spreadsheet.
- schema.json — JSON Schema for one record, so you can validate rather than guess.
India Cyber Threat Scorecard
A monthly count of publicly observable cyber threat activity affecting organisations in India, across 23 industry verticals. Aggregate data only; no organisations are named. The same 23 verticals and the same counting rules every month, so this month’s figure for your sector means something against last month’s. 2 editions published so far; a published edition never changes. The current edition is September 2026, published .
- Read the scorecard — the current grid, the archive, and the method behind the bands.
- latest.json — always the current edition, at a URL that does not change.
- schema.json — JSON Schema for one edition.
- Per-edition JSON and CSV are linked from each edition’s own page.
India BFSI Readiness Index
Post-quantum key exchange, certificate lifetime and validity, CAA, DNSSEC, security.txt and DMARC across all 125 Indian banks, insurers and market infrastructure institutions on the RBI, IRDAI and SEBI lists. Sector aggregates. Each edition records the day it was measured and the lists it was drawn from; a published edition never changes.
- Read the October 2026 edition — the findings, the interactive sector view and the method.
- india-bfsi-readiness-2026-10.json — every cohort and lens, with tested and not-read counts.
- india-bfsi-readiness-2026-10.csv — one row per cohort and lens.
Using them
Every file is served with permissive cross-origin headers, so you can fetch it straight from a browser or a notebook without proxying it first. Nothing here is rate-limited, gated or behind a form.
If you publish something built on any of them, we would like to see it — and if you find an entry that is wrong, tell us and we will re-read the source. The register carries a verification date per row precisely so that a stale entry is visible rather than assumed.
Building an assistant or an agent against these — a custom GPT, a Claude project, a retrieval pipeline — rather than a script? openapi.json describes the register and the scorecard as a set of unauthenticated GET operations, importable directly as an Action or a tool definition.
Or skip the plumbing: the regulation connector puts the register and the incident clocks straight into Claude, ChatGPT or any MCP client, as tools the assistant calls and cites.