Remember Contagion — the film where a virus doesn’t announce itself with sirens, it just travels.
Patient zero shakes a hand, touches a doorknob, breathes in the wrong elevator, and by the time anyone realizes what’s happening, the outbreak spreads from one city to everywhere.
And no one can trace exactly which door it came through.
The movie is a good reference to understand what SEBI Chairman Tuhin Kanta Pandey spoke at the inauguration of a symposium for cyber defence organized by SEBI — except the thing spreading isn’t a virus, it’s a cyberattack, a breach.
And the ‘elevator’ is a vendor, a cloud platform, a third-party tool sitting somewhere between your savings and your broker’s servers. Someone you have never met. Someone you would never think to ask about.
A cyberattack, the SEBI Chairman warned, doesn’t need to breach your bank or your brokerage directly to reach your money.
Like the film’s central premise, it can begin at one organisation and travel — through a vendor, a technology platform, a third party, a connected institution — arriving at your account through a door you never knew existed.
For the millions of people who trust the financial system to simply work — who assume that if their bank looks secure, their money is secure — this is the same quiet horror the film built its entire plot around: the illusion of individual safety in a fully networked system. The SEBI Chairman’s reframing lands the same way.
The question is no longer whether your institution is secure. It’s whether the entire ecosystem it depends on is resilient. Just like in Contagion, being careful yourself was never really the whole story — you were always exposed to everyone else’s exposure too.
He was equally blunt about when, not if — the line every outbreak movie eventually says out loud. “The more relevant question is: When it happens, how ready are we?” he told the gathering. It’s the regulator’s version of the CDC scene in the film, the moment someone stops asking “can we prevent this” and starts asking “do we have a plan for when we can’t stop it.”
Pandey said that every company needs a plan where people know their roles — who decides when an incident occurs, who isolates the affected system, who communicates with regulators and the public. It’s the financial-sector equivalent of a hospital’s outbreak protocol — unglamorous, procedural, and precisely the thing that determines whether a crisis stays contained or becomes a headline.
He even flagged a threat with a Contagion-style delayed fuse: data stolen today that stays dormant until quantum computers can unlock it years from now — information sitting in a database right now that “can be captured today and potentially decrypted in the future.”
No outbreak, no visible symptoms, no deadline you can see coming. Just exposure, waiting.
His closing line was the one that broke the metaphor open entirely: “Cybersecurity is no longer only an IT issue. It is a board-level issue. It is a business-continuity issue. It is a market-integrity issue. It is an investor-confidence issue.”
