A New Cyber Institute Is Welcome. A Cyber-Mature Banking System Would Be Better.

This weekend, India added another impressive building to its cybersecurity landscape: the RBI’s greenfield Data Centre and Enterprise Computing & Cybersecurity Training Institute in Bhubaneswar. It is Tier IV, fault-tolerant, sited away from border and seismic risk, and built to keep the central bank’s core systems running even in the worst of times.

I want to say clearly: this is a good effort, and resilience at the core of our financial system matters.

But I also want to ask the question nobody at an inauguration asks. Will it change anything at the edges, where Indian banking is actually being breached?

The core is not where the fire is

In the very week the ribbon was being prepared, SBI, India’s largest bank, disclosed that 3,897 customer records with names, mobile numbers, dates of birth, addresses and loan details had surfaced on the dark web. The bank did not find this itself; it learnt of it from external alerts, after the data was already out. At the same time, an Indian certificate authority had to watch Mozilla, Google, Apple and Microsoft block its intermediate certificates because some of its private keys were numbers as small as 4.

Neither incident happened inside a central bank data centre. They happened where they always happen: in commercial institutions, in vendors, in processes, in governance.

The RBI’s systems are not the weakest link. Commercial banks are. Each runs its own infrastructure, its own vendors, its own branch networks and its own legacy systems, and each connects into the national payment fabric. An adversary does not need to breach Bhubaneswar or Kharghar. They need one under-patched server, one compromised employee mailbox, one contractor with too much access.

We are not short of institutions

India already has NIBM in Pune, IDRBT in Hyderabad, CAFRAL, and the RBI’s own colleges. SBI alone runs dozens of State Bank Training Units and regional training centres. Every large bank has a training calendar, and every calendar has a cyber module.

So the honest question is: if training capacity were the problem, why hasn’t it been solved already?

My view, from years of working with banks, is that the bottleneck is not buildings. It is culture.

Too many of our training institutions are deeply “sarkari”: bound by protocol, measured by the number of programmes conducted and participants certified, not by whether a single bank became harder to breach afterwards. Faculty are often rotated in from administrative roles. Content lags threats by years. Nobody is incentivised to say, “This programme did not work; let us scrap it.” When success is counted in sessions held rather than incidents prevented, complacency is not a personal failing. It is the system working as designed.

The people holding the line are exhausted

Meanwhile, the CISOs of many large banks sit in some of the most vulnerable chairs in Indian finance. They carry accountability for risks they don’t fully control, budgets they must fight for every year, boards that often see cyber as a compliance checkbox, and an audit cycle that rewards documentation over defence. The job is relentless, and when a breach happens, the CISO is the first name in the room and frequently the last person consulted beforehand.

If we want resilient banks, we must stop treating the CISO as a fuse designed to blow and start treating the role as a board-level function with real authority, protection and tenure.

What gets measured gets fixed, and we aren’t measuring

Here is the uncomfortable truth: the cyber maturity of most Indian banks, especially mid-sized, cooperative and regional ones, is not independently assessed and certainly not published. We grade banks on capital adequacy and NPAs. We do not give customers, investors or even boards a comparable picture of how prepared a bank is to detect, contain and disclose a breach.

And when things go wrong for the customer, where do they turn? The banking ombudsman. Yet many ombudsman offices remain under-equipped to handle cyber-related complaints: data leaks, SIM-swap fraud, account takeovers, social-engineering losses. A customer whose data was leaked deserves more than a form reply that funds were “unaffected.” They deserve to be told, protected and, where appropriate, compensated.

What I would rather see funded

Before the next institute is announced, I would like to see:

1. Independent, periodic cyber-maturity assessments of every bank, with a summary rating disclosed to boards and, eventually, to the public.
2. Outcome-based evaluation of training institutions: fewer certificates, more red-team results, incident-response drills and measurable reduction in findings.
3. Protection and authority for CISOs: direct board access, minimum tenure, and clear separation from IT delivery pressures.
4. Cyber literacy for ombudsmen and grievance officers, so customers harmed by digital failures get informed adjudication.
5. Mandatory, time-bound customer notification after a data exposure, not just a stock-exchange filing.
6. Shared threat intelligence and joint exercises that bring smaller and cooperative banks into the same defensive fabric as the large ones.

Inaugurations are not outcomes

A data centre protects data. An institute trains people. Neither, by itself, creates cyber maturity. That comes from accountability, honest measurement and the political will to fix what is unglamorous.

Success will not be measured by what we inaugurate, how much we allocate, or what we announce. It will be measured by whether the next leak happens at all, and if it does, whether the customer hears about it from their bank before they hear about it from a fraudster.

What would you change first? I’d genuinely like to hear from CISOs, bankers and trainers who live this every day.