LowII Cyber Warfare & Critical Infrastructure5 November 2026, Thursday

Pakistan's CERT warns banks and the power grid of AI-driven attacks

Pakistan's National CERT on 5 November warned banks and critical infrastructure operators of coordinated attacks using artificial intelligence, automated bots and agentic tools. The advisory names 7 sectors including banking but contains no figures on damage.

Location: ISLAMABAD

According to Minute Mirror on 7 November and Aaj News on 6 November, the advisory, titled AI-driven threats, lists 3 risks for banks: disruption of digital banking, automated login attempts on accounts and manipulation of balances displayed on screen. On the OT side (operational technology, the systems that run physical processes such as valves, pumps and grids), 5 areas are named as targets: oil and gas, water, power generation and distribution, manufacturing and transport. The advisory cites 2026 attacks on supermarket refrigeration systems in Europe as a precedent, although the use of AI in those attacks has not been confirmed.

This is the second signal in 3 days. According to PhoneWorld on 3 November, National CERT Director General Haider Abbas told the parliamentary IT committee that Pakistan has faced more than 1,000 cyber attacks in 2026. TechJuice reports that the 5 November advisory recommends multi-factor authentication, regular reconciliation of balances shown to customers against core banking records and separation of OT networks from IT systems; it carries no binding enforcement or budget.

Through an insurance lens, the most critical of the 3 banking risks is the scenario of manipulating balances to trigger panic. Under the model clauses Lloyd's has required since 2023, a state-backed cyber operation that seriously impairs a state's financial market infrastructure or public services can fall outside cover. In a country that has seen more than 1,000 attacks in 2026, attributing a major bank or grid attack to a state would mean the loss is paid not by the policy but from the balance sheets of institutions and the state.

Talay assessment

Bottom line

Pakistan's advisory defines the threat but brings no binding enforcement or budget; the constraint stays with institutions' own capacity. More than 1,000 attacks and a target list that reaches into OT raise the risk that an attack turns into a physical outage. Attribution to a state could push losses outside cover because of the policy exclusion; this reading would be refuted if Pakistani banks were able to buy additional cover for state-backed attacks.

Likely effects

Pakistani bankingNegativeWeeks
A balance-manipulation scenario could spark a deposit panic even without any loss of funds; banks bear the cost of reconciliation and monitoring.
Energy and water infrastructureNegative1–6 months
The advice to separate OT networks from IT requires investment by utilities running legacy control systems; the 5 November advisory has no budget line.
Cyber insuranceNegative6 months+
Attributing a major attack to a state raises the risk that the loss falls outside cover under the state-backed attack exclusion.

Possibilities, ranked

1
The advisory stays advisory60%
Institutions apply the measures on their own timetable; new attack reports continue but no systemic outage occurs.
Watch: National CERT's next periodic attack count
2
The central bank sets binding rules25%
The State Bank of Pakistan imposes mandatory audit and reporting requirements on banks for AI-driven attacks.
Watch: A cybersecurity circular from the State Bank of Pakistan
3
A major incident and attribution15%
An attack causes a physical outage at a bank or on the grid and is formally attributed to a state.
Watch: Reports of an outage lasting hours in banking or power distribution

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Market reaction

Indicators affected

Sectors in the advisory▼ 7
Attacks reported in 2026▼ 1,000+

Bottom line

Likely effects

Possibilities, ranked

Sources