India’s rapid shift towards a more connected digital economy is widening the attack surface for cybercriminals, with cyber incidents rising sharply as businesses deepen their reliance on cloud platforms, artificial intelligence (AI), digital payments and connected systems.
The number of cybersecurity incidents detected across government and financial institutions in India rose from 11.46 lakh in 2023 to 18.73 lakh in 2024 and further to 24.39 lakh in 2025, according to data presented in Parliament in July 2026.
The vulnerability is particularly pronounced in sectors such as financial services and healthcare, which hold large volumes of sensitive data and provide critical services. A government report presented in August showed that official agencies, including the Indian Computer Emergency Response Team (CERT-In), detected more than 3.6 lakh cyber threat incidents across the banking and healthcare sectors in the first six months of 2026. Banks alone faced 17 targeted intrusion campaigns.
In the financial sector, malicious scanning and probing incidents stood at 3.09 lakh during the first half, while incidents involving vulnerable services totalled 39,319, taking the overall number to 3.49 lakh. Healthcare recorded 18,259 malicious scanning and probing incidents and 596 involving vulnerable services.
The threat is also moving beyond traditional IT infrastructure. Recent incidents involving Bank of Baroda, Tata Electronics, Angel One, Niva Bupa Health Insurance and cryptocurrency exchange WazirX underline how attackers are exploiting employee credentials, cloud resources, sensitive data and digital assets.
The financial cost is rising alongside the frequency of attacks. According to IBM’s 2026 Cost of a Data Breach Report, the average organisational cost of a data breach in India has reached a record ₹25.5 crore.
AI accelerates
“Between October 2024 and May 2026, Seqrite Labs, India’s largest malware analysis facility, recorded 156.3 million detections across more than 7.7 million endpoints, an average of 700,000-plus detections every day,” said Harish Kumar GS, CEO, Quick Heal Tech.
Trojans and file infectors accounted for 70 per cent of the detections, while ransomware, network exploits, credential theft, and AI-assisted phishing are becoming sophisticated. Education, healthcare and manufacturing accounted for 47 per cent of detections.
The rapid adoption of AI is adding another dimension to cyber threats. Attackers are using AI to automate reconnaissance, make phishing campaigns more convincing and accelerate the identification and exploitation of vulnerabilities. Organisations are deploying the technology for threat detection, predictive intelligence, automation and faster incident response.
“In the fastest incidents we investigated within our 2026 Global Incident Response Report, attackers moved from initial access to data exfiltration in just 72 minutes, four times faster than the previous year,” said Kunal Ruvala, senior vice-president and general manager, India, Palo Alto Networks. Ruvala said third-party SaaS applications were leveraged in 23 per cent of the incidents investigated.
Identity has emerged as a weak point, with weaknesses involving user accounts, passwords and permissions playing a material role in 90 per cent of the investigations.
The growing capabilities of frontier AI models could increase the risk by enabling attackers to identify and chain vulnerabilities at speeds that would have been difficult to achieve manually, narrowing the gap between vulnerability discovery and exploitation.
Reactive to pre-emptive
“India’s digital success story should not be outpacing security maturity,” said Apeksha Kaushik, senior principal analyst, Gartner.
India needs greater investment in cybersecurity talent, modernisation and AI-driven defences, alongside a shift towards pre-emptive security, Kaushik said. Gartner expects pre-emptive cybersecurity solutions to account for 50 per cent of IT security spending by 2030, compared with less than 5 per cent in 2024.
The threat landscape is expanding beyond conventional malware and ransomware to social engineering, email compromise, synthetic identities, biometric fraud, deepfakes, IoT vulnerabilities and autonomous malware. “Building cyber resilience requires organisations to move beyond reactive security and adopt a proactive, intelligence-led approach,” Kumar said.
For businesses, this means identifying where identities, applications, data and third-party connections are creating exposure, reducing implicit trust and ensuring that security controls keep pace with digital operations.
Policy measures will have a role to play through stronger incident reporting and information sharing, secure-by-design practices and greater scrutiny of software and SaaS supply-chain security.
Audit concerns
CERT-In has mandated private and public-sector organisations that own or operate digital systems to undergo a comprehensive third-party cybersecurity audit at least once a year. Regulated sectors face stricter and recurring audit requirements.
“In most cases, companies are selecting auditors based on the lowest tender without checking their competency. As a result, security loopholes remain. The best hackers today are more competent than the worst auditors,” said Sandeep Sengupta, founder and director, Indian School of Anti Hacking.
Long way to go
Sengupta said India still has a long way to go in building cyber resilience and strengthening its defences against attacks originating from different geographies.
“We have to improve self-reliance in both software and hardware. But the situation is improving. The Digital Personal Data Protection Act has a compliance deadline of May 13, 2027. After that, if there are data leaks, companies will be liable to penalties reaching up to ₹250 crore,” he said.
