PTA has released its Cyber Security Annual Report 2025-26, covering regulatory, technical, organizational and capacity building work carried out between July 2025 and June 2026 across Pakistan’s telecom sector, along with its plans for the coming years. Prepared by the Cyber Vigilance Division, the report puts the Critical Telecom Data and Infrastructure Security Regulation 2025 (CTDISR-2025) at the centre of its regulatory work. The regulation is a full revision of CTDISR-2020 and now stands at 14 chapters, 87 regulations, 366 sub-regulations and 389 sub-regulation clauses, down from 19 chapters and 104 regulations. It adds stronger requirements for asset management, cloud security, access control, insider threat detection, business continuity and human resource security, and it is aligned with ISO/IEC 27001:2022, NIST CSF 2.0 and ISO/IEC 20000. PTA also issued 5G Security Guidelines for the phased rollout of 5G networks and Guidelines for Mitigation of Distributed Denial of Service attacks. On the operational side, the National Telecom Security Operations Centre (nTSOC) kept round-the-clock watch over more than 40 connected telecom licensees. Its alert handling chart shows 18,011 alerts received, including 11,528 high severity and 6,483 critical alerts, with 1,124 escalated to operators. Dark Web monitoring identified 326 significant cyber threat indicators, made up of 174 website defacement incidents (53 percent), 87 data leak incidents (27 percent), 41 DDoS related occurrences (13 percent) and 24 cases (7 percent) involving the advertisement or sale of sensitive information. nTSOC issued 59 cyber threat advisories, of which 30 concerned vulnerabilities, 19 malware and exploits, and 10 targeted cyberattacks, and it took down more than 600 phishing websites and unauthorized or illegal seller accounts and pages.
A dedicated Emergency Cyber Control Room was activated for Independence Day (13 to 15 August 2025), Defence Day (5 to 7 September 2025) and Pakistan Day (1 to 30 March 2026), with more than 600 indicators of compromise analyzed during the Independence Day operation alone. The Pakistan Day activation recorded 24 public-sector data leak incidents, 13 public-sector website defacements, 5 DDoS incidents, 2 broadcast hijacking incidents and 1 case involving data selling. Fortnightly non-intrusive scans of public-facing infrastructure gave the sector an average cybersecurity risk score of 9.0 out of 10, with licensees required to fix identified issues within seven days of a report. Over 80 operators completed third party audits, and PTA revalidation audits covered 40 licensees, up from 13 in 2022-23, 21 in 2023-24 and 35 in 2024-25, spread across Islamabad (21), Lahore (11) and Karachi (8). Licensees reached full compliance in Breach of Condition of Regulations and Inspection, with high scores in incident management (96.7 percent) and reporting requirements (95.2 percent), while confidentiality of information (42.9 percent), malware protection (47.8 percent), the cybersecurity framework (52.4 percent) and service continuity management (52.4 percent) were flagged as persistent gaps. PTA also revised its Third-Party Audit Firm Registration Criteria. Separately, it traced phishing SMS messages sent from short codes to fake BTS equipment, ran a nationwide awareness campaign with banks and safe-city authorities, and saw a sharp fall in calls mimicking helpline and toll-free numbers after monthly reconciliation of operator reports. It coordinated with the National Cyber Crime Investigation Agency (NCCIA), which conducted raids on suspected illegal call centers.
Capacity building formed another part of the year’s work. A five-day DNS Operations and DNSSEC Workshop with ICANN from 21 to 25 July 2025 helped lift Pakistan’s DNSSEC revalidation score to 91 percent from 20 percent, the highest in the region at the time of reporting. PTA and Huawei organized the Next-Gen Cyber Resilience Workshop and Telecom Cybersecurity Awards 2025 on 12 August 2025, with discussions on 5G, Low Earth Orbit satellite internet, artificial intelligence and FinTech. Cybersecurity Awareness Week 2025 ran from 11 to 17 December 2025 under the theme Building a Safe, Secure, and Resilient Cyberspace, using PTA’s digital channels, and closed on 18 December in Islamabad in collaboration with UNDP, with Federal Minister for Information and Broadcasting Attaullah Tarar among those present. On 30 June 2026, PTA and PTCL jointly hosted an industry workshop on Internet Resilience covering operational resilience, business continuity and protection of critical communications infrastructure.
For the coming period, planned under the Pakistan Telecom Cybersecurity Strategy 2023-28, PTA said the CTDISR-2025 Implementation Framework is in its final consultation stage and will set control-wise expectations and assessment criteria for licensees and auditors. A dedicated CTDISR Audit Portal is planned to be fully deployed and onboard all licensees before the next audit cycle, alongside a Third-Party Audit Firm Registration Portal to replace manual registration. For the 2027-28 audit cycle, PTA plans 100 percent revalidation coverage of Category I licensees and a random selection of five licensees each from Categories II, III and IV. It also plans to institutionalize Cybersecurity Awareness Week in the last week of October, build a dedicated Incident Response Team for cyber fraud complaints, and push licensees toward more intelligent and automated SOC capabilities using measures such as Zero Trust, MFA, PAM, EDR and NDR. On digital accessibility, PTA has adopted WCAG 2.2 (ISO/IEC 40500:2025) as the national reference standard, to be applied through CTDISR 2025, Chapter XIV, Clause 85, while the Ministry of IT has notified a committee to study nationwide adoption.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
