Cyber security

As organisations accelerate adoption of AI, cloud, and emerging technologies, the conversation today is no longer just about transformation - it is about enabling trusted and responsible transformation at scale.

Organisations need to implement secure-by-design practices, continuous monitoring, automation for rapid response action as well as technology-enablement of governance for machine speed decisioning to confidently innovate with greater speed, resilience, and trust. In a cloud environment, one additionally requires a clear understanding of shared responsibility model, deploying right security controls and crucially maintaining unified view of the entire environment.

Cybersecurity budgets are often built on legacy structures, not real risk. The result is a disconnect between where organisations invest and where their true exposure lies.

A risk based approach shifts this conversation. It starts by aligning every investment to a clearly defined and quantified risk, ensuring that spending directly contributes to reducing exposure. It also calls for adaptability, where budgets evolve alongside changing threats, and transparency, where every stakeholder can see the link between spend and outcomes.

This is not just a financial exercise. It is a fundamental shift in how organisations think about cybersecurity. Moving from static line items to risk led priorities enables smarter allocation, stronger resilience, and clearer communication with leadership.

When budgets are tied to measurable risk reduction, cybersecurity stops being a cost discussion and becomes a value conversation.

• In our 'always-on' world, digital trust is earned when a service is not just convenient, but consistently available and inherently secure. Beyond the code, trust is psychological - a user’s confidence that a system will act in their best interest without cause for harm. Building digital trust today requires a convergence of reliability, resilience, and an infrastructure agile enough to pivot with business needs while responding instantly to security events. Ultimately, this trust is solidified through robust communication, ensuring the user is not only protected but remains consciously aware and confident in the system’s integrity.
• Digital trust is the intersection of technical security and resilience, and psychological safety. It is built when 'fit-for-purpose' services are consistently secure and available, backed by an infrastructure that can adapt to user needs and security threats at lightning speed. To trust a system is to believe it will act in our interest, every single time.

Human intelligence has driven modern economies; the next phase of growth will depend on how well we harness intelligent data. As this report suggests, data risk is market risk. Treating data as core market infrastructure is critical for India to sustain market leadership and investor confidence.

Rachit Chhokera

Partner, DT-Cyber Strategy and Govn
KPMG in India

Cross-border data governance is where GCCs face real complexiity. Some of the key friction points that need deeper attention.

• Global vs local rules:Aligning HQ‑led data policies with country‑specific privacy, retention, and localisation laws
• Data visibility: Achieving accurate data discovery and lineage across systems to prove compliance end-to-end
• Third-party risk: Governing vendors and processors operating across borders, with inconsistent controls and oversight.

As AI scales across governance, OT, data platforms, and agentic systems, one fact stands out. Cyber resilience is now a collective responsibility and demands a full 360 degree view.

A few realities we cannot ignore:

• Threat actors have the same tools we do
  They move without guardrails or governance. Their speed is increasing. Our defenses must adjust just as fast
• AI in operational tech will be the hardest frontier
  IT environments are challenging enough, but energy grids, airports, and industrial systems were never built for AI driven autonomy. Securing them will take a very different playbook
• Businesses want more data. Cyber teams pay the price
  More data fuels better models, but it also expands exposure and complexity. 

For years, the easy answer to trust was to keep a human in the loop.

Agentic AI breaks that model. If the agent completes the loop, the human becomes irrelevant. If we force the human back in, the system loses the efficiency it promised.

That is the tension we must solve next. Not with slogans, but with real engineering, governance, and clarity on where autonomy is acceptable.

One of the things India has been proud of is the speed, the ability to innovate and drive outcomes using digital technologies. One of the key challenges around this digital revolution is how do we protect personal data. The DPDPA Rules are foundational for us to become Digital India and continue the journey of acceleration on how we bring digital into our everyday life.

While the large corporations in India may be ready for the new DPDP rules, the ecosystem of partners, vendors, suppliers, etc. may not be ready - this is one of the significant holes in the entire readiness for our country. Smaller organisations have a lower level of understanding to start with, and also sometimes implementation of DPDP rules.

It's not the notice, it's not the consent, it's not about getting your system right, it's about getting your ecosystem right. Because larger organisations will take several months just to educate their ecosystem partners what it is, why is it important, even before they start to put the first process in.

Generative AI brings immense promise, but trust will depend on going back to the basics. It starts with solving the right problems, using the right data, and understanding the risks that extend beyond security. True confidence in AI comes from human validation, cross‑functional collaboration, and compliance with emerging regulations. Building trusted AI is not a choice for tomorrow, it is a responsibility for today.

Trust has become the true currency of the digital world. It reminds us that security, privacy, transparency, and responsible conduct are not optional; they are the foundations on which lasting digital relationships are built.

Indian enterprises have recognised the impact due to cyber risk, and the recent spate of cyber incidents has further heightened the sensitivity. The Cert-In guidelines are timely and comprehensive. It is heartening to see the inclusion of attack vectors like VPNs, supply chains, and access controls, which have been repeatedly exploited in recent breaches. With hyperconnected applications, multi-cloud adoption, and AI-enabled platforms growing rapidly, security audits must now be conducted by teams that understand threat exposure and can apply professional judgment.

TMT industry is at forefront of digital innovation and rapidly adopting technologies to derive business value. The dynamism demands CISO to address the evolving cyber threats landscape and have a proactive and strategic approach. Cyber leaders are pivoting to establish Trust and thereby enhance the competitive positioning of organisations.