Cybersecurity as a Core Risk Priority

India’s digital economy is booming, with over 971 million internet users and digital transactions hitting record levels. However, this growth has made the country a prime target for cybercriminals. In 2025, cybersecurity has solidified its position as a core enterprise risk within Governance, Risk, and Compliance (GRC) frameworks, demanding board-level attention and strategic integration.

 

The Escalating Threat Landscape

According to the Seqrite India Cyber Threat Report 2025, India faced over 265 million cyberattacks in 2025, with Trojans and file infectors accounting for the majority. Malware detections reached 369 million across monitored endpoints. Globally, India ranked high in malware (3rd) and email threats (2nd), with sectors like BFSI, government, healthcare, and manufacturing bearing the brunt.

Key threats dominating the landscape:

• Ransomware and phishing surges
• AI-driven attacks, including deepfakes
• Supply chain vulnerabilities
• Geopolitical and state-sponsored incidents

States such as Maharashtra, Gujarat, and Delhi emerged as hotspots due to their dense digital infrastructure.

 

Driving Forces Behind the Priority Shift

Several factors have elevated cybersecurity in GRC priorities:

• Regulatory Evolution: The Digital Personal Data Protection (DPDP) Act 2023 and Rules 2025 mandate reasonable security safeguards, mandatory breach notifications within 72 hours, and penalties up to ₹250 crore. CERT-In’s directives require incident reporting within hours, log retention, and now mandatory annual cybersecurity audits for organizations.
• Economic Stakes: Cybercrime losses are projected to impact billions, with increasing regulatory fines adding pressure.
• Digital Expansion: Initiatives like Digital India and UPI have amplified the attack surface.

 

Best Practices for Strengthening Cybersecurity in GRC

Indian organizations are adopting proactive measures:

1. Zero-Trust Architecture: Relentless verification of all access requests.
2. Continuous Monitoring and AI-Driven Detection: For real-time threat response.
3. Regular Audits and Employee Training: Aligning with CERT-In requirements and fostering a security-aware culture.
4. Robust Third-Party Risk Management: Rigorous vendor assessments.
5. Integrated GRC Platforms: Providing unified visibility and automated compliance.

With a talent gap exceeding 1 million professionals, investments in skills development are critical.

 

Future Outlook

Cybersecurity spending in India is forecasted to reach $3.3 billion in 2025, growing at 16-20%. As India positions itself as a global cybersecurity hub, treating it as a core GRC priority will build resilience, ensure compliance, and drive sustainable digital growth.