Advisory on Emerging Advanced Artificial Intelligence (AI) Tools for Vulnerability Detection (like Mythos)

X X   X X   Extracts   X X   X X

Full Text of the Document

X X   X X   Extracts   X X   X X

....sts (RAs) All KYC Registration Agencies (KRAs) All Merchant Bankers (MBs) All Mutual Funds (MFs)/ Asset Management Companies (AMCs) All Portfolio Managers All Registrar to an Issue and Share Transfer Agents (RTAs) All Stock Brokers through Exchanges All Stock Exchanges All Venture Capital Funds (VCFs) Dear Sir/Madam, Subject: Advisory on Emerging Advanced Artificial Intelligence (AI) Tools for Vulnerability Detection (like Mythos) A. The rapid evolution of emerging technologies including AI-driven vulnerability identification tools (E.g. Claude Mythos) has introduced new dimensions of risks for Regulated Entities. Such tools may give rise to heightened risk exposure by enabling identification and potential e....

X X   X X   Extracts   X X   X X

Full Text of the Document

X X   X X   Extracts   X X   X X

....latforms like Mythos and discuss the mitigation measures. Based on the consultation with the said task force, an advisory is enclosed at Annexure-A. E. This advisory should be read in conjunction with the applicable SEBI circulars (including but not limited to Cybersecurity and Cyber Resilience framework) and any subsequent updates issued by SEBI from time to time. F. This circular is issued in exercise of powers conferred under Section 11 (1) of the Securities and Exchange Board of India Act, 1992, to protect the interests of investors in securities and to promote the development of, and to regulate the securities market. Yours Faithfully, Mamata Roy Deputy General Manager Phone: 022-26449599 Email: [email protected] ....

X X   X X   Extracts   X X   X X

Full Text of the Document

X X   X X   Extracts   X X   X X

....zation mechanisms to enable secure verification of end-user client identity as well as limit the information access/ transfer to users/ systems based on least privilege. c) API rate limiting and throttling to prevent and detect abuse. d) Connections through APIs to be strictly on a whitelist-based approach. 6. SOC Monitoring: a) Regular day-to-day monitoring of the systems and networks must be carried out vigorously. SOC alerts should be adequately examined including the low-priority alerts. b) Implement enhanced security orchestration and Automated Response (SOAR) playbooks integrated with Security Incident and Event Management (SIEM) solutions, after thorough testing wherever feasible. c) Th....