No Money Was Stolen. So Why Is a Bank Data Leak Still a Big Deal? SBI’s recent data exposure is a reminder that in banking cybersecurity, the damage does not always begin with money leaving an account. IBM’s 2026 Cost of a Data Breach Report found that phishing was the most common initial attack vector in India, accounting for 19% of breaches. A bank data leak is serious even when no money is stolen, because exposed personal data such as names, phone numbers and dates of birth can make phishing and impersonation far more convincing. When a bank reports a cyber incident, most people ask the same question first: Was any money stolen? In the SBI incident, the answer appears to be no. In a 21 October exchange filing, SBI said a preliminary analysis of around 3.75 lakh records found on the dark web identified 3,897 customer records containing personal information The compromised information included names, mobile numbers, dates of birth, email addresses, residential addresses, customer identifiers and loan-related records. The bank said customer balances remained safe and that the incident was not expected to materially affect its core operations. That sounds reassuring. And in one sense, it is. But it is also a good example of why measuring a banking data breach only by immediate financial loss misses a large part of the risk. Personal data can become the first step in a much longer attack A name, phone number and date of birth may not move money on their own. Together, however, they can make the next attack far more convincing. A scammer who already knows your bank, loan details, address or personal identifiers does not need to begin a phishing call with a vague story. They can build one around information that feels legitimate. That matters in India, where phishing remains one of the most common ways attackers get in. IBM’s 2026 Cost of a Data Breach Report found that phishing, including voice and SMS phishing, was the most common initial attack vector in India, accounting for 19% of breaches. The same report put the average cost of a data breach in India at ₹25.5 crore, up 15.9% from 2025. For financial services, the figure was much higher: ₹40.9 crore on average, the highest among Indian industries studied. So “no money was stolen” is important. It just is not the end of the cybersecurity conversation. Banks are also dealing with attacks that bypass the customer completely There is another reason this story is worth watching. Earlier in October, CERT-In and CSIRT-Fin warned of cyber campaigns targeting NBFCs, digital lenders, fintech companies, payment providers and wallet operators. The attackers were not simply tricking customers into sharing OTPs. They were compromising internet-facing systems, stealing payment and partner-bank API credentials, and then calling **disbursal and fund-transfer APIs directly**. In some cases, this allowed them to bypass normal application controls around KYC, loan creation, beneficiary verification and transaction limits. That changes the threat model. The attack does not always need to come through the front door of a banking app. If an attacker gets access to the trusted infrastructure behind it, legitimate systems can be used to perform illegitimate actions. RBI’s response shows how seriously that shift is being taken On October 19, the Reserve Bank of India reportedly issued fresh directions to banks, payment operators and other regulated entities after recent cyber incidents. One instruction stands out: After exposed credentials or confirmed unauthorised access, organisations should treat the technology environment as compromised until it has been forensically cleared. RBI also asked entities to tighten administrative access, enforce multi-factor authentication, rotate exposed credentials, maintain inventories of APIs and shut down dormant or test APIs. The underlying message is fairly simple. Do not assume that because one compromised account has been fixed, the attack is over. Banking cybersecurity is becoming a trust problem India’s banking system is increasingly connected through APIs, cloud platforms, fintech partners, mobile applications and automated workflows. That connectivity is what makes modern digital banking possible. It also means a breach can travel in ways that are less obvious than a fraudulent transaction appearing on a statement. IBM’s 2026 research adds another layer: 26% of malicious breaches studied in India were AI-generated, while organisations with no AI and security automation spent an average ₹31.6 crore per breach, compared with ₹21.3 crore among those using it extensively. Attackers are getting faster. Banking infrastructure is getting more connected. The cost of getting security wrong is rising. The lesson from the latest incidents is not that digital banking has become unsafe. It is that the definition of a serious banking cyberattack has changed. Sometimes money disappears. Sometimes credentials do. Sometimes customer data ends up somewhere it should never have been. And increasingly, security teams have to assume that any one of those could be the beginning of what comes next… For cybersecurity professionals, that shift is also changing the kinds of roles organisations need. As AI, identity, cloud, data, and autonomous systems create new attack surfaces, roles are emerging around AI security, red teaming, threat intelligence, governance, and AI-enabled security operations. We’ve mapped some of those career paths in our latest e-book, The AI Security Career Guide, including the skills professionals may need to build as #cybersecurity evolves. forms.gle/sJsNo3r5gpg5hxLY9

AI Is Breaking the Cybersecurity Career Ladder For years, cybersecurity’s biggest problem was a shortage of skilled people. AI is now creating a second one: a shortage of the right skills. AI is increasingly automating tasks that once formed the foundation of entry-level cybersecurity work, including alert triage, log analysis, vulnerability prioritization, reporting, and basic threat hunting. That sounds like progress. In many ways, it is. But it raises a harder question: If AI takes over the work junior cybersecurity analysts traditionally learned from, how do organizations develop the next generation of senior cyber professionals? That may become one of the most important workforce questions in cybersecurity. Is AI reducing entry-level cybersecurity jobs? AI is already reducing the need for certain repetitive entry-level cybersecurity tasks, although it is not eliminating junior roles altogether. Think about how a security analyst traditionally learns the job. You start small. You investigate alerts. You read logs. You chase false positives. You escalate suspicious activity. You document what happened. You get things wrong. Over time, you start recognizing patterns. None of that sounds glamorous. But repetition is often where judgment gets built. AI is now stepping into that first layer of work. In a 2026 ISC2 study of cybersecurity professionals already using AI, 56% said AI had somewhat or significantly reduced the need for entry-level positions over the previous year. That raises the bar for early-career professionals. Tasks that once helped juniors learn on the job are increasingly being automated, pushing new entrants to arrive with stronger practical skills, better judgment, and greater familiarity with AI-enabled security workflows. Why does cybersecurity still have a skills gap if AI is automating work? Because AI is reducing some kinds of work, not the need for cybersecurity expertise itself. Cybersecurity does not suddenly have too many people. Quite the opposite. ISC2 reports that 88% of professionals have experienced at least one significant cybersecurity consequence because of skills shortages. Its broader workforce research also found that 95% of cybersecurity professionals reported at least one skill needed in their organization. So, the contradiction is hard to ignore. Organizations still need more cybersecurity capability. At the same time, AI is reducing demand for some of the repetitive tasks that traditionally gave beginners their first exposure to the field. We may be moving toward: more cybersecurity work + fewer traditional junior tasks + a higher bar for getting started That is not simply a talent shortage. It is a career-pipeline problem. Is AI replacing cybersecurity work or changing it? AI is more likely to change cybersecurity work than remove it completely. This is where the “AI will take cyber jobs” narrative becomes too simplistic. ISC2 found that cybersecurity professionals using AI are spending more time reviewing AI-generated recommendations and deciding whether those recommendations should be trusted or acted upon. That changes the nature of the job. The analyst of the future may spend less time asking: What does this alert mean? Is the AI right about this alert, and what happens if I trust it? That second question requires context, judgment, scepticism, and experience. Ironically, those are often the very skills people develop by doing the first kind of work. How will junior cybersecurity professionals build experience? Entry-level cybersecurity roles will likely need to become more supervised, more AI-aware, and more focused on judgment rather than repetitive execution. If AI summarizes logs, ranks vulnerabilities, flags anomalies, and drafts incident reports, where does a new analyst get enough exposure to know when the machine is wrong? That is not something a certification can teach on its own. Cybersecurity is messy. Evidence conflicts. Signals are incomplete. False positives can look convincing. Genuine threats can look harmless. Judgment comes from seeing those situations repeatedly. Which creates an uncomfortable loop: Cybersecurity may need more experienced professionals at exactly the moment it is automating some of the work that helped create experienced professionals. The answer is probably not to preserve repetitive work just for the sake of training people. It is to redesign the entry-level role. What will an entry-level cybersecurity job look like in 2027? Junior cybersecurity roles may shift from manually processing information to supervising, validating, and challenging AI-assisted security systems. There is already evidence that this change is beginning. While 56% of ISC2 respondents saw reduced need for some traditional entry-level roles, 53% said AI was also creating new types of entry-level positions. A junior analyst in 2027 may spend less time manually sorting alerts and more time: validating AI recommendations investigating unusual edge cases supervising automated workflows testing AI systems reviewing AI-agent behavior supporting AI-enabled security operations That changes the baseline skill set. Cybersecurity fundamentals still matter. But so do AI literacy, automation, model risk, data, governance, and the ability to challenge AI-generated conclusions. ISC2 also found that more than 70% of professionals expect AI to create greater demand for strategic and specialized cybersecurity skills. The career ladder is not disappearing. It is being rebuilt. Which AI-security roles are emerging? The next wave of cybersecurity careers is increasingly appearing at the intersection of AI, security, governance, and operations. Some of the emerging roles include: AI Red Team Specialist AI Security Architect AI-Enabled SOC Lead AI Governance & Risk Specialist AI Penetration Tester AI Threat Intelligence Engineer AI/Model Security Specialist Forward-Deployed AI Security Engineer We mapped these roles, the skills they require, and the career paths that can lead into them in the AI Security Career Map. Download the AI Security Career Map - forms.gle/3GAf54t4Z4mnxsMN7 The guide explores what these roles do, the capabilities they require, and how professionals from cybersecurity, cloud, data, engineering, and risk backgrounds can begin moving toward them. #CyberSecurityAwarenessMonth #AISecurity #AI #GreatLearning #PowerAhead

“Agentic AI moved from being an interesting concept to something I could genuinely imagine designing and applying to real-world products and enterprise workflows.” "After more than two decades in product and fintech, I felt that AI, particularly Agentic AI, was going to fundamentally change how digital products are designed, built and operated. At this stage of my career, I did not want to understand AI only at a conceptual or managerial level. I wanted enough hands-on understanding to identify the right use cases, evaluate technical approaches and work meaningfully with engineering and data science teams. That was a major reason I joined the @iitbombay Agentic AI Program. I wanted to bridge my product and domain experience with a deeper understanding of LLMs, RAG, agents, orchestration, MCP, evaluation and AI-driven decision systems. I was particularly interested in understanding how these capabilities could be applied to real business problems in financial services, from credit decisioning and risk and fraud monitoring to customer support, collections, operational workflows and internal analytics. I also wanted to understand where Agentic AI genuinely creates value and how it can complement existing technology approaches. One of the biggest highlights of the program for me has been learning about agent orchestration, particularly using LangGraph, along with agentic memory and maintaining state across an agent workflow." After more than two decades across fintech, digital payments, and consumer technology, Pushkar Sinha, Head of Product, RapiPay Fintech Pvt Ltd, wanted to move beyond understanding AI at a conceptual level. He joined the Certificate in Agentic AI by IIT Bombay to build a hands-on understanding of LLMs, RAG, agents, orchestration, MCP, and AI-driven decision systems. Program highlights: Faculty-led curriculum design by IIT Bombay's Department of Computer Science and Engineering (CSE) - Four modules, five months, built for working professionals - Weekly live sessions with guided labs and hands-on projects - Industry-relevant tools including LangGraph, CrewAI, FAISS and Claude Code - One-day optional campus immersion at IIT Bombay His advice? "The real learning happens when you experiment beyond what is asked." Explore the full program bit.ly/4dS09kG #PowerAhead #GreatLearning #IITBombay #AgenticAI

"AI is changing how we learn and work, but I don’t think it makes learning obsolete. I’d argue it makes continuous learning more important. Think of AI as a multiplier. A 4th grader’s conversation with AI looks very different from a doctoral student’s, because the tool amplifies what you bring to it. As the technology improves, the amplification grows, but it still multiplies your understanding and ability to brainstorm. That’s been true of most productivity technologies, like spreadsheets. Here’s an example. Say a retailer uses AI to forecast demand, and the model predicts a big jump next month. Should they immediately stock up? It depends. Was the forecast driven by an unusual one-time spike? How expensive is holding excess inventory? AI can generate the prediction, but knowing how reliable it is, what assumptions drive it, and how to turn it into a sound decision requires understanding statistics, ML, and decision-making. A prediction is not a decision. The decision requires context, trade-offs, and judgment about consequences. What has changed is that education can no longer be sequential, where you learn first and then work. It has to run in parallel with everything else, just to keep up. So I wouldn’t judge the value of learning AI/ML by how fast the tools are changing. The tools will keep changing. The ability to frame the right problem, evaluate the results, and make informed decisions is what lasts. Learning the tools is useful, but understanding when and why to use them is what makes that knowledge valuable." Has AI made you want to learn more or less? Tell us below. #AMA #GreatLearning #PowerAhead

Does AI make learning obsolete? In yesterday’s Reddit AMA, Dr. Kumar Muthuraman, Faculty Director of the PG Program in AI & ML at The McCombs School of Business @UTAustin, argued the opposite: it makes continuous learning more important. A user asked: How can you say AI/ML is the right path for education when AI is making learning obsolete and catching up pretty quickly? Here's what Dr Kumar says 👇