Every October, cybersecurity gets its annual moment in the spotlight. We are reminded to use stronger passwords, think before clicking, spot phishing emails and keep our digital doors locked. Yet, in an Indian workplace, a developer may be pasting code into a personal AI account to fix a bug, while a finance analyst uploads a customer list to summarise it. Neither intends to compromise security, and neither action may appear in the organisation’s security reports.
The advice on the posters remains sensible. But the risks facing enterprises are changing. Knowing that threats exist is one thing; knowing where an attacker might find a way in is quite another. As applications multiply, AI tools enter everyday workflows and vendors connect to internal systems, the number of doors to watch is growing faster than most organisations realise.
The Door Employees Open Themselves
India’s enthusiasm for generative AI illustrates the challenge. According to a 2025 Boston Consulting Group survey, 92% of Indian employees use GenAI tools regularly, against a global average of 72%.
Netskope’s India 2026 report shows what that enthusiasm puts at risk. The average organisation in India records more than 3,000 AI-related data policy violations every month, over ten times the global average, and almost half of them involve source code. Much of this activity runs through personal AI accounts, contributing to the rise of shadow AI, where employees use AI applications without their organisation’s approval or oversight.
Banning tools may appear to be the simplest response, but it can push their use further underground. Organisations first need visibility into which tools employees use, what information they share and where that information goes.
India’s AI Governance Guidelines encourage proportionate accountability, algorithmic auditing and self-certification. For businesses, that means being able to demonstrate which AI systems they use, who approved them and how their risks are assessed. A policy may explain what should happen, but it cannot establish what is actually happening inside the organisation.
Risk Runs Further Down the Chain
Cybersecurity cannot operate on an annual calendar when the digital world changes by the hour. Employees change roles, new vendors come aboard, software gets connected and access permissions accumulate. Some of the most significant risks now sit even further from an organisation’s direct control.
Consider a vendor that has passed a security assessment but relies on another provider to deliver its services, which in turn depends on suppliers of its own. The organisation has assessed its direct vendor, yet these fourth parties remain outside its field of vision. AI adds another layer. A software vendor may introduce a feature that routes customer information to an external model provider, which relies on further service providers, so data can travel through organisations the customer has never assessed or contracted with. Under the DPDP Act, an organisation remains responsible for personal data even when a processor handles it on its behalf.
The scale of the problem is already visible. In a SecurityScorecard study of key Indian suppliers published in 2025, 52.6% had experienced a third-party breach in the past year, while only 10.7% had publicly reported a breach. When incidents within the supply chain are this hard to see, exposure is hard to assess.
Treating security as a periodic exercise is a little like checking the locks once a year while handing out keys every week, without knowing how many copies are being made.
Evidence Is the New Currency of Trust
The gap between what an organisation believes is secure and what is actually happening inside its digital environment is where risk often takes root. It is also where evidence becomes essential.
Under CERT-In’s directions, specified cyber incidents must be reported within six hours of being noticed or brought to an organisation’s attention. Regulators, enterprise customers and auditors may also require evidence of security controls and vendor oversight. When those questions arise, an organisation needs current information about its systems, suppliers, access permissions and response procedures.
A questionnaire completed at onboarding cannot account for every change that follows. Evidence gathered once a year may describe an organisation that no longer exists in the same form.
What organisations need, therefore, is continuous visibility into their digital environments. They must know what assets they have, who and what can access them, which vendors and sub-processors they depend on, and where emerging risks require attention. Just as importantly, someone must be accountable for acting on what these checks uncover.
Awareness Is the Beginning, Not the Lock on the Door
None of this makes human awareness less important. Employees remain an essential line of defence. But awareness must work alongside continuous monitoring, appropriate access controls, effective third-party oversight and clear accountability.
This year’s Cybersecurity Awareness Month theme from the US-based National Cybersecurity Alliance, “Don’t Make It Easy for Them”, is sound advice. For Indian business leaders, it also raises five questions. Do we know which AI tools our employees use? Who approves new AI use cases? Can we identify the sub-processors our critical vendors rely on? Could we assemble the necessary information to meet a six-hour reporting deadline? And is our security evidence current today, or does it reflect our last audit?
Trust in India’s digital economy will increasingly belong to organisations that can demonstrate their security continuously, well beyond the month the calendar sets aside for it.
The real measure of cybersecurity is how much harder we make it for an attacker to get in, even when someone forgets to lock the door.
Join our LinkedIn group Information Security Community!
