Resources Categories
INDUSTRY FACT FILE · CAPITAL MARKETS
Market Landscape and the Drivers of Cybersecurity Demand in Capital Markets
The business, technology, regulatory, legal and statutory forces that create cybersecurity, audit and assurance work for capital market entities.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: SEBI CSCRF 5. Other regulatory drivers 6. Legal and statutory drivers 7. How the drivers differ by participant 8. What this means for buyers and for Codec Networks |
1. Market landscape
Retail participation has transformed the market: CDSL alone reported more than 18.59 crore demat accounts as on 30 June 2026. At the same time, SEBI's CSCRF has turned cybersecurity into a graded, recurring compliance programme for every regulated entity.
|
18.59 cr Demat accounts at CDSL (30 June 2026) |
5 CSCRF regulated-entity categories |
CERT-In Empanelled auditors required for CSCRF audits and VAPT |
6 hours Incident reporting to SEBI and CERT-In |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
MIIs |
Exchanges, clearing corporations, depositories; most stringent controls |
Red teaming, resilience testing, SOC efficacy, frequent audits |
|
Large brokers and Qualified REs |
High volumes, apps and APIs, large security teams |
Half-yearly audits and VAPT, threat hunting, app and API testing |
|
Mid-size brokers and intermediaries |
Growing digital channels, lean teams |
Managed SOC, CSCRF audits, platform testing |
|
Small and self-certification REs |
Limited capacity, need baseline compliance |
Gap assessments, policy packs, M-SOC onboarding, annual audits |
|
Market technology vendors |
Serve many REs that must assess them |
Secure SDLC, VAPT, client assurance packs |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Regulatory compliance |
CSCRF audit cycle, SEBI inspections, MII audits |
CSCRF cyber audits, VAPT, evidence management |
|
Platform availability |
Outages on high-volume days damage clients and invite scrutiny |
Resilience and DDoS testing, SOC |
|
Investor trust |
Account takeovers, fake apps and data leaks |
App testing, brand monitoring, privacy programmes |
|
Fraud and unauthorised transfers |
Losses from compromised accounts and back-office misuse |
Access reviews, maker-checker testing, forensics |
|
Growth and new products |
New apps, APIs, algo offerings and cloud services |
Pre-launch testing, cloud framework assessment |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Trading apps and APIs |
Account takeover, API abuse, business-logic flaws |
App and API security testing |
|
Algo and low-latency trading |
Faulty or malicious strategies, risk-check gaps |
Algo change-control and risk-limit reviews |
|
Cloud services |
Misconfiguration and shared-responsibility gaps |
SEBI cloud framework assessments |
|
Legacy back-offices |
Weak access controls and patching gaps |
Infrastructure VAPT, privileged-access audits |
|
AI in operations |
New AI-specific vulnerabilities and data leakage |
AI security testing and governance |
Figure 3: The four groups of drivers behind cybersecurity spending in capital markets.
4. Regulatory drivers: SEBI CSCRF
SEBI's Cybersecurity and Cyber Resilience Framework (circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024) superseded earlier SEBI cybersecurity circulars and set graded requirements aligned with recognised standards.
|
Area |
Key requirements |
|
Applicability and timelines |
Applies to specified categories of SEBI regulated entities, graded into MIIs, Qualified, Mid-size, Small-size and Self-certification REs Compliance by 1 January 2025 for MIIs, KRAs and QRTAs, and by 31 August 2025 for all other REs (after extensions in 2025) |
|
Governance |
Board-approved cybersecurity and cyber resilience policy; defined roles including a CISO; periodic review by the Board or its committee |
|
Audits and testing |
Cyber audits and VAPT performed by CERT-In empanelled IS auditing organisations, with frequency depending on category—more frequent for MIIs and Qualified REs Time-bound closure of findings and revalidation |
|
Monitoring |
24x7 SOC for MIIs, Qualified REs and Mid-size REs (own, group, managed or Market SOC); smaller REs onboard to the Market SOC operated by NSE and BSE unless they run their own SOC Periodic measurement of SOC efficacy |
|
Resilience and maturity |
Cyber Capability Index assessments for MIIs (third-party) and Qualified REs (self-assessment) Recovery objectives for critical systems of MIIs and Qualified REs, clarified in 2025 |
|
Incident reporting |
Cyber incidents reported to SEBI within six hours of detection, with follow-up reporting and root-cause analysis; CERT-In reporting within six hours in parallel |
|
2025 updates In April 2025 SEBI revised categorisation thresholds (including for stock brokers) and in August 2025 issued technical clarifications. Certain data-localisation provisions were placed in abeyance in December 2024 until further notification. Entities should track the latest circulars and FAQs. |
5. Other regulatory drivers
|
Instrument |
Applies to |
Key cybersecurity relevance |
|
SEBI framework for adoption of cloud services (6 March 2023) |
SEBI regulated entities adopting cloud |
Cloud governance, shared responsibility, data security, vendor risk and exit readiness |
|
SEBI system audit frameworks |
Stock brokers, MIIs and other entities as specified |
Periodic system audits and closure of findings |
|
SEBI circular on system audit of professional clearing members (20 June 2024) |
Professional clearing members |
System audit and circular compliance review |
|
Exchange and depository circulars |
Members and participants |
Operational, technology and reporting requirements set by MIIs |
|
NCIIPC notifications |
Entities with protected systems |
Additional controls for critical information infrastructure |
Figure 4: Regulatory timeline for capital markets cybersecurity, as of October 2026.
6. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
SEBI Act, 1992; SCRA, 1956; Depositories Act, 1996 |
Basis for SEBI regulation of MIIs and intermediaries |
Regulatory audits and supervisory responses |
|
IT Act, 2000 and CERT-In Directions (28 April 2022) |
6-hour reporting; ICT logs for 180 days in India; clock synchronisation |
Logging, incident readiness, SOC |
|
DPDP Act, 2023 and Rules, 2025 |
Investor personal data; most obligations from May 2027 |
Data mapping, safeguards, breach workflows |
|
Prevention of Money Laundering Act, 2002 |
Reporting-entity obligations |
Transaction monitoring and KYC reviews |
7. How the drivers differ by participant
|
Participant |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Exchanges and clearing |
Market integrity, uptime |
Matching engines, colocation |
CSCRF (MII), NCIIPC, SECC |
|
Depositories |
Integrity of holdings |
Depository systems, DP interfaces |
CSCRF (MII), Depositories Act |
|
Stock brokers |
Client growth, uptime, trust |
Apps, APIs, algos, cloud |
CSCRF by size, system audits, cloud framework |
|
DPs and custodians |
Asset safety, institutional trust |
Back-office systems |
CSCRF, depository circulars |
|
RTAs and KRAs |
Investor data, issuer trust |
Investor databases, KYC systems |
CSCRF (MII/QRE), DPDP |
8. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“Which CSCRF category are we, and where are the gaps?” |
Categorisation and gap assessment |
Annual reassessment |
|
“We need a CSCRF cyber audit and VAPT.” |
CERT-In empanelled audit and VAPT |
Audit cycle by category, with revalidation |
|
“We need a 24x7 SOC or M-SOC readiness.” |
Managed SOC and M-SOC onboarding support |
Monitoring and SOC efficacy reporting |
|
“We are moving to the cloud.” |
Assessment against SEBI's cloud framework |
Continuous cloud assurance |
|
“We must report incidents within six hours.” |
IR retainer and playbooks |
Drills and on-call response |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document summarises regulatory and legal instruments as published up to October 2026. It is not legal advice. CSCRF requirements depend on each entity's category; confirm obligations against the current SEBI circulars, clarifications and FAQs.