Name: Bitsight Security Ratings, SPM and TPRM — delivered by BitScore
Brand: Bitsight
Availability: InStock

Start here

Three things to open before Dhanteras

Our own research on India’s financial institutions, the month’s threat count, and the games that teach the season’s lures — each one open to use, with nothing to sign up for.

Research · October 2026

BFSI Readiness Index

56%

of the Indian bank, insurer and MII websites tested accept post-quantum key exchange — but only 12 of 122 certificates are ready for 100-day lifetimes

Read the index

Monthly · aggregate only

India Cyber Threat Scorecard

67

India-linked incidents in September 2026, 26 of them data breaches

See the scorecard

Three daily games

Agent Arcade

3

daily games about AI agents — with festive-season traps dealt only in the festive weeks

Play today’s games

Why the season

The money peaks at Diwali. So do the attacks.

Payment volume peaks, on-call schedules thin out, and the lures write themselves. None of it pauses a reporting clock.

₹27.28 lakh crore

moved over UPI in October 2025¹

9.6% more than September, as festive spending peaked — 20.7 billion payments in one month.

754 million

UPI payments on Dhanteras 2025²

The busiest day of October 2025, 13% above that month’s daily average of 668 million.

29.44 lakh

cyber incidents handled by CERT-In in 2025³

With 1,530 alerts and 65 advisories issued over the year.

6 hours

to report a cyber incident to CERT-In⁴

From the moment you notice it — Diwali night included. Banks, brokers and insurers owe more filings on top.

Days to hours

from break-in to damage, with AI agents attacking⁵

CERT-In rated it critical on 15 October 2026. The organisations hit did not detect it themselves.

67

India-linked cyber incidents in September 2026⁶

Data breaches, ransomware claims and network access offered for sale — counted, never named.

The festive risk calendar

Six dates, six things to do

Each festival brings its own lure — and leaves a window to close something before the next.

11–19 Oct
Navratri
RISK
Sale-season phishing starts: fake offers, fake delivery notices, fake KYC.
DO
Check who may send mail as your domain — before customers get mail that isn’t yours.
20 Oct
Dussehra
RISK
Change freezes begin, and with them the urge to defer patches until after Diwali.
DO
Close the findings an outside view would see first. Freeze code, not fixes.
6 Nov
Dhanteras
RISK
Peak payment volume. Last year it was UPI’s busiest day of October.
DO
Rehearse the six-hour clock with the people who will actually be on call.
8 Nov
Diwali
RISK
Skeleton teams, bonus files and gift-voucher requests: the lure is real, the sender is not.
DO
Nothing pays out from an emailed file. One person confirms every new payee.
11 Nov
Bhai Dooj
RISK
Teams return to a backlog of alerts nobody triaged over the long weekend.
DO
Read the logs from the week. Retain them: CERT-In asks for 180 days.
13 Nov
DPDP Consent Managers
RISK
The first DPDP rule to commence lands the week after Diwali.
DO
Know which DPDP obligations bind now and which wait until 13 May 2027.

Navratri week, CERT-In

Two critical advisories in the week the season began

Ordinary weaknesses, used at extraordinary speed — and in both, the victims did not find out on their own.

CIAD-2026-0046 · Critical · 9 Oct 2026

Payment and disbursement APIs abused for unauthorised fund transfers in BFSI

Who: NBFCs, digital lenders, fintechs, payment service providers and wallet operators

Attackers steal payment-gateway and partner-bank API credentials, then call the disbursal API directly from the entity’s own whitelisted servers — skipping KYC, sanction and limits — and move money over IMPS and NEFT to mule accounts.

Inventory every API; switch off deprecated and test ones.
Replace long-lived static tokens; keep keys in a vault or HSM.
Maker-checker and a daily ceiling on every fund movement.
Retain logs for at least 180 days.

Read CIAD-2026-0046 on cert-in.org.in

CIAD-2026-0049 · Critical · 15 Oct 2026

AI agents as attack vectors

Who: Every organisation with credentials, APIs or cloud roles reachable from the internet

AI agents — some under evaluation by model providers, some run by criminals with open-source tools — reached Indian systems through exposed credentials, dormant APIs and over-permissive cloud roles. The weaknesses were ordinary. The speed was not.

Hunt for credentials in code, commit history and CI variables; rotate what you find.
Take admin interfaces off the internet; MFA on every one that stays.
Alert on enumeration bursts and bulk reads, not just failed logins.
Give your own agents short-lived identities and default-deny egress.

Read CIAD-2026-0049 on cert-in.org.in

Three festive drills

Before the rush, on the night, in the boardroom

Every tool answers on its own page. Pick the drill that matches your week.

Drill 1

Before the rush

Your outside view, your regulator, your sale-season domain.

Drill 2

On the night

The six-hour clock, the tabletop, and AI agents at machine speed.

Drill 3

Boardroom and vendors

Seven slides, eight questions, and the suppliers carrying your peak.

Inside the playbook

Seven chapters, every tool and article linked

The PDF carries the figures and the checklist. The page carries every link.

Chapter 1

Before the rush: your outside view

Attackers pick targets from what they can see from outside. So do insurers and customers.

A spoofable domain or an expired certificate is cheap to fix in October and expensive to explain in November, when phishing in your name lands in a million festive inboxes.

Chapter 2

When it breaks on Diwali night

The six-hour clock does not stop for festivals, and banks, brokers and insurers owe more than one filing.

Most late filings are not decisions; they are a duty officer who did not know the clock had started. Rehearse it with the people on the festive schedule.

Chapter 3

Regulated BFSI: what the season does not pause

The RBI’s seven 2026 Directions, SEBI’s CSCRF and IRDAI’s 2026 Guidelines all apply through the festive weeks.

An inspection after the season asks what was true during it. Know which instrument binds you, what the board must approve, and what an examiner would test.

Chapter 4

Vendors at peak load

Payment gateways, logistics partners and call centres carry your festive traffic — and CERT-In’s 9 October advisory shows their API keys are the target.

A breach at a supplier is still yours to report, and an annual questionnaire says nothing about a supplier listed on a leak site last week.

Chapter 5

The boardroom

The board’s last meeting before year-end is when festive-season risk gets signed off — or doesn’t.

Directors do not need a threat briefing. They need seven slides and eight questions they can put to the CISO.

Chapter 6

Festive-peak sectors: e-commerce, retail, payments, travel

The season’s traffic peak is yours, and so is the peak in brand impersonation.

Customers who are phished in your name blame your name. Email authentication, credential hygiene and the CERT-In clock are the three controls that travel with the traffic.

Chapter 7

AI in the festive season

This season, some of the attackers are AI agents — and some of your own staff are approving what AI agents ask for.

CERT-In’s 15 October advisory says the weaknesses AI agents exploit are ordinary ones, found faster. The rules that bind your AI today are fewer than the headlines suggest, and the six-hour clock already covers an AI incident.

Four weeks to Bhai Dooj

The festive checklist

Sixteen things, four a week. The PDF has it as a page to print and pin.

Week 1

19–25 Oct · Dussehra

Run Check your domain and the email spoofing check
Raise DMARC to enforcement; publish CAA and security.txt
List the ten suppliers that would stop revenue
Request the Cyber Risk Rating Report

Week 2

26 Oct–1 Nov

Fix in order: certificates, then exposed services
Hunt for keys in code and CI; rotate what you find
Switch off dormant and test APIs
Board brief and director’s questions to the secretary

Week 3

2–8 Nov · Dhanteras, Diwali

Print the incident clock for every entity you report for
Tabletop with the festive on-call schedule
Payroll and payments: no change from an emailed file
Agent Arcade as a team, every day

Week 4

9–15 Nov · Bhai Dooj

Triage the alerts from the long weekend
Confirm logs are kept for 180 days
Check what DPDP binds from 13 November
Read the October Threat Scorecard

The full picture

Your complimentary Cyber Risk Rating Report

All nineteen vectors, your Bitsight rating on the 250–900 scale, and where you sit against your industry — 45 minutes for listed entities, up to 48 hours for everyone else.

Request the report Get the playbook

Figures are read at source on the dates in the playbook’s source list. Regulatory summaries are indicative, not legal advice; reference numbers for every instrument are in the Indian cyber regulation register.

Cybersecurity Festive Playbook 2026