Pakistan cyberattacks 2026 have crossed the 400 mark, and the country’s top cyber defence agency says every single attempt was stopped before it could cause serious damage. The disclosure comes from Dr. Haider Abbas, Director General of Pakistan’s National Cyber Emergency Response Team (National CERT or PKCERT), who has also made two big demands: a dedicated law to regulate artificial intelligence and a brand-new National Cyber Security Authority reporting directly to the Prime Minister.
Pakistan Cyberattacks 2026: How Bad Is the Threat?
The numbers tell a clear story. The director general of Pakistan’s National CERT revealed that more than 400 cyberattacks targeted Pakistan during 2026, but all were thwarted through timely detection and response. To put that in context, Pakistan recorded 927 cyberattacks in 2024 and 2025 combined. That means in just one year, 2026, attacks are on track to match or exceed the total of the two previous years combined. The threat is not just growing; it is speeding up.
Not all of these are the work of lone hackers. The cyberattacks included attacks that were state-sponsored. State-backed attacks are far harder to stop. Abbas noted that state-sponsored cyber attacks pose a particular challenge, as they are often more coordinated and resourced than attacks carried out by individual actors, making a unified national strategy essential.
One attack earlier this year showed how real the risk is. The online billing system of the Capital Development Authority (CDA) was hit by a ransomware attack that disrupted revenue collection and affected thousands of residents in Islamabad. The hackers reportedly accessed sensitive billing data, demanded a Bitcoin ransom, and threatened to leak the stolen information on the dark web.
What Is National CERT and What Does It Do?
The National Cyber Emergency Response Team (PKCERT) is a government agency located at the Pak Secretariat in Islamabad, under the Cabinet Division, currently headed by Dr. Haider Abbas. It is a national initiative aimed at strengthening cyber security in Pakistan. The government of Pakistan announced the formation of the country’s first National CERT on 11 March 2024. That makes it barely two years old, yet it is already absorbing hundreds of attacks every year.
At the national level, the CERT does not work alone. All the sector regulators in Pakistan are considered as sectoral CERTs, including the Pakistan Telecommunication Authority (PTA) and all telecom operators, the State Bank of Pakistan (SBP) and all the banks, SECP, NEPRA, OGRA, the Higher Education Commission (HEC), and the Civil Aviation Authority of Pakistan (CAA). These bodies are each setting up their own security operations teams, and a federal government CERT is also planned as the next step.
The Proposed National Cyber Security Authority
Dr. Abbas says the current setup is not enough. The increasing number of cyber threats highlights the need for stronger national cyber security structures and better coordination among institutions responsible for protecting digital systems.
Speaking on the growing scale of cyber threats, particularly those backed by state actors, Dr. Abbas proposed the creation of a powerful National Cyber Security Authority to be led by the Prime Minister. He suggested that the proposed authority should operate under the leadership of the Prime Minister to ensure effective decision-making and coordination.
The proposed body would have real teeth. The authority would be responsible for recommending cybersecurity measures for critical national infrastructure and would oversee the implementation of cybersecurity practices across the country. Dr. Abbas also suggested that institutions failing to implement cybersecurity measures should face penalties, emphasizing that accountability is necessary to improve national cyber resilience.
This proposal has been in the pipeline for a while. Pakistan is preparing a Cyber Security Act and a dedicated regulatory authority to strengthen defenses against rising digital threats as the country rapidly digitizes government services and economic systems, IT Minister Shaza Fatima said earlier in 2026. The new 400-plus figure now gives that push fresh urgency.
The Call for a Dedicated AI Law in Pakistan
Beyond the new authority, Dr. Abbas raised another alarm. Dr. Haider Abbas called for legislation to ensure the safe and responsible use of artificial intelligence in Pakistan. He warned that AI has the potential to be used as a weapon if left unregulated, making legal safeguards essential.
Dr. Abbas stressed that cybersecurity is now inseparable from national security and called for stronger institutions, stricter compliance, and legislation to regulate the safe use of artificial intelligence. This is an important gap. Right now, Pakistan has no standalone AI law. Any bad actor could use AI tools to launch smarter phishing attacks, generate deepfakes, or automate large-scale intrusions, with little legal risk.
This fits into a wider national debate. Pakistan has been building out its digital infrastructure fast, including the PM Cloud Programme for a sovereign cloud, yet the legal framework to protect that infrastructure from AI-driven threats simply does not exist yet. An AI law would close that gap.
What Pakistan Has Built So Far: PISF 2026 and SOCs
While legislation is still pending, some groundwork is already being laid. Pakistan has developed the Pakistan Information Security Framework 2026 (PISF 2026), which establishes compliance requirements and auditing controls to strengthen information security standards across organizations. This is currently under review by the Cabinet and has been presented to parliament. Once approved, it will become the first national cybersecurity standard to apply across all sectors in Pakistan.
On the hardware and software side, Dr. Abbas said a formal mechanism is needed to examine all software and hardware imported into Pakistan before use. To support this objective, Pakistan has established a Common Criteria Lab to test and certify software and hardware for security compliance. All software and hardware used in government institutions will undergo a mandatory screening process, while the Pakistan Security Standard is scheduled to be fully implemented from June 2028.
Every organisation, public or private, also faces a hard deadline. Authorities have issued a six-month deadline to all public and private organisations to establish and operationalise Cybersecurity Operation Centres (COCs) equipped with SIEM, EDR, NDR, and XDR solutions for continuous threat monitoring. A Security Operations Centre (SOC) is basically a team and set of tools that watches a network around the clock, looking for suspicious activity before it becomes a breach.
Why This Matters for Everyday Pakistanis
Cyberattacks on government systems are not just an IT problem. When a government body gets hit by ransomware, services stop. Bills do not get processed. Data gets stolen. Citizens lose trust in digital services they depend on for banking, utilities, and identity. A stronger cyber framework directly protects the public.
For Pakistan’s growing tech sector, clear cybersecurity rules and an AI law also send a positive signal to foreign investors and business partners who want to know their data is safe in Pakistan.
Frequently Asked Questions
How many cyberattacks did Pakistan face in 2026?
Pakistan faced more than 400 cyberattacks during 2026, according to National CERT DG Dr. Haider Abbas. All attacks were successfully detected and stopped. This compares with 927 attacks across all of 2024 and 2025 combined, showing the threat is growing rapidly.
What is the National Cyber Security Authority proposed for Pakistan?
It is a new high-level body that Dr. Abbas wants to place under the Prime Minister’s office. It would oversee cybersecurity across all government and private sectors, set mandatory security standards, and penalise organisations that ignore their cyber duties.
Why is Pakistan calling for an AI law?
Dr. Haider Abbas warned that AI can be turned into a weapon if it has no legal guardrails. Attackers can use AI to run more sophisticated cyberattacks. A dedicated law would set rules for how AI is developed and used in Pakistan, making it harder to misuse.
What is PISF 2026?
PISF 2026 stands for Pakistan Information Security Framework 2026. It is the country’s first national cybersecurity standard, covering compliance and auditing rules for all organisations. It is currently with the Cabinet and Parliament for approval and will be rolled out across all sectors once passed.
