Cybersecurity Awareness Month: India’s Need For Democratised Cybersecurity Ecosystem

October marks the annual ‘Cybersecurity Awareness’ month. Several campaigns are run through month as awareness is certainly an important aspect of security in our digital ecosystem. However, awareness coupled with democratisation (access and affordability) of high-quality security solutions would create an ideal scenario for an emerging market like India which has a mix of large corporates, startups, and medium-sized businesses. 

Ironically, the Cybersecurity Awareness month saw two major security incidents that rocked the global digital ecosystem. 

First up is eMudhra, which saw its some certificates were spotted with weak keys, making them extremely vulnerable to reverse engineering through brute-force attacks and key derivation due to low entropy. Following the fix, the company announced it was withdrawing from the global SSL/TLS certificate business.

ALSO READ: eMudhra Security Incident: Company Pledges Enhanced Operational Controls

The second one is the PHP vulnerability. Widely used as a popular server-side programming language, the vulnerability was in the wild for more than a decade. The vulnerability compelled governments across the world to release fixes. 

Managed Cybersecurity Capability

Even as cybersecurity is considered as an important aspect, many deem it as an additional cost. And it varies considerably depending on the size of the business given the complexity of its IT infrastructure, the sensitivity of the information it handles and the level of protection required. 

For an Indian business with approximately 100 employees, basic endpoint protection and security hygiene could cost around INR 50,000–INR 2 lakh annually, according to Ashok Harris, Cofounder and CEO, K7 Cybersecurity. 

“More advanced protection, including endpoint detection and response, could cost INR 2–5 lakh, while comprehensive managed security involving continuous monitoring, threat investigation and incident response could cost INR 5–15 lakh or more. These are indicative annual budget ranges for different levels of protection, rather than industry averages. Costs can be substantially higher for complex environments or broader service commitments,” he said. 

Harris also pointed out that purchasing cybersecurity software is very different from having a continuously managed cybersecurity capability.

Smaller businesses, for instance, mostly rely on basic antivirus software and a firewall, assuming these provide adequate protection. Others have acquired additional security products but lack the expertise or centralised visibility to understand their overall exposure.

A newer study conducted by Tata Tele Business Services & CyberMedia Research (CMR) shows that 35% of Indian SMEs conduct cybersecurity reviews only quarterly or half-yearly, making it the single largest operating model. Another 26% approach cybersecurity on an ad-hoc basis, responding only when an incident or visible disruption occurs. Moreover, more than six in ten SMEs in India continue to operate with extended periods of limited or no continuous security oversight. 

ALSO READ: Indian SMEs’ Need For Robust Cyber Resilience

Apeksha Kaushik, Sr Principal Analyst at Gartner, puts this into perspective, saying that an ecosystem can reduce cybersecurity costs by reducing complexity—not simply by offering cheaper tools. Many enterprises manage overlapping products, separate dashboards, multiple contracts and expensive integrations. 

An integrated ecosystem can consolidate controls, centralise visibility and automate routine monitoring and response. That can lower operational overhead and reduce the need for scarce specialist skills.

“For Indian organisations, managed security services can further democratise access by allowing smaller businesses to consume enterprise-grade capabilities without building a large in-house security team. However, consolidation should not mean dependence on a single proprietary vendor. Enterprises should look for open APIs, interoperability, data portability and transparent pricing. The right measure is total cost of ownership, including deployment, integration, staffing, monitoring and incident response, not just the software licence,” she adds. 

According to Rajveer Shah, Global Chief Strategy Officer, MITSUMI Distribution, Cybersecurity costs can be reduced through subscription-based pricing, integrated security platforms and managed services. 

“These models help SMEs avoid significant upfront investments and reduce the

need for dedicated in-house security teams. Technology distributors, vendors and system integrators can further support affordability through appropriate solution selection, vendor-led training and simplified deployment. The focus should be on reducing the total cost of ownership without compromising security.”

Access: Plug-and-play

Can the industry take notes from the success of UPI? Is it plausible to have plug-and-play cybersecurity solutions available at scale? It could be, but it’s complex. 

Kaushik explains that some cybersecurity capabilities can increasingly be delivered in a plug-and-play manner, including endpoint protection, identity controls, email security, backup, vulnerability scanning and baseline cloud security. This is especially valuable for smaller organisations that need a practical security baseline without building a large specialist team.

“However, comprehensive cybersecurity is not completely plug-and-play. Organisations with legacy systems, sensitive data, complex identities, customised applications or sector-specific requirements still need assessment, configuration, integration and ongoing tuning,” she adds. 

“The most realistic model is a tiered service: standardised protection for smaller businesses, managed monitoring and response for growing organisations, and tailored architecture for larger enterprises. Plug-and-play should mean faster, simpler and more repeatable deployment, it should not imply that governance, accountability and expert oversight are no longer necessary.”

Another school of thought is revisiting how cybersecurity is developed, delivered and managed. 

For many Indian SMEs, the problem is not that they have too many security products. They may have only basic antivirus software and a firewall, with little understanding of their actual exposure. Even businesses that invest in additional tools often lack the specialist expertise required to manage them effectively.

“Building an in-house cybersecurity team is beyond the financial and operational capabilities of most SMEs. Attracting and retaining experienced cybersecurity professionals is difficult, and maintaining round-the-clock security operations requires considerable investment.This creates a significant opportunity for Managed Security Service Providers (MSSPs),” Harris adds. 

“By combining integrated cybersecurity technologies with shared security operations and specialist expertise, MSSPs can deliver continuous monitoring, threat investigation and incident response to multiple businesses at a fraction of the cost of establishing equivalent capabilities in-house. Regional and local MSSPs have a particularly important role to play. They understand their customers’ businesses, provide local support and can build long-term relationships. By partnering with cybersecurity technology companies, they can deliver sophisticated protection without having to develop every underlying security capability themselves.”

He also stresses Artificial intelligence can make this model even more efficient. AI-assisted software development can accelerate innovation, while intelligent automation can reduce the effort involved in investigating, responding to and resolving security incidents.

Equally important is accountability. SMEs should not have to coordinate between multiple technology vendors when an incident occurs. They should have one clearly identified service provider accountable for their contracted security operations, with defined responsibilities for monitoring, investigation, remediation, escalation and reporting, according to K7 Cybersecurity CEO. 

Pankit Desai, CEO and Co-Founder of Sequretek adds that Cybersecurity is modular by nature. For every element of an organization, whether endpoints, network, cloud, or applications, security capabilities are available as modules. 

“Now security companies are also able to provide platforms that can operate as plug and play, which give better visibility and response. So, a business does not need to have a monolithic solution that bundles far more than it needs. That flexibility is something security already has,” Desai adds.

Future of B2B Cybersecurity 

AI is fundamentally changing software engineering. Development activities that previously required significant time and engineering resources can increasingly be accelerated using AI-assisted coding and automation.

This lowers barriers to entry and enables smaller teams to develop sophisticated software much faster.

However, there is a fundamental difference between writing cybersecurity software and building a cybersecurity platform that genuinely protects an enterprise.

“Effective cybersecurity requires a deep understanding of evolving threats, attacker behaviour, operating systems, networks and the complex interactions between security technologies. It also requires the ability to distinguish genuine threats from legitimate activity, minimise false positives and deliver reliable protection without disrupting business operations,” said Harris. 

Kaushik of Gartner adds that the B2B cybersecurity market is likely to move from standalone products toward integrated platforms, managed services and security embedded within broader IT contracts. Buyers will increasingly want fewer overlapping tools, simpler operations and measurable improvements in risk reduction, detection and response.

Managed security services should grow in importance as many Indian businesses cannot economically build a full security operations capability internally. At the same time, demand will expand for cloud security, application security, identity, data protection, privacy and controls for AI-enabled systems.

The market will not become entirely standardised. Large enterprises will continue to require specialised architectures, while smaller organisations will favour affordable, preconfigured and managed packages. Cybersecurity will increasingly become part of broader IT-service engagements. The winners will be providers that combine simplicity and automation with strong integration, transparency, resilience and clear accountability.

Rupesh Kumar, Chief Product and Technology Officer, WeWork India, notes that cybersecurity is no longer just about protecting systems; it is about protecting business continuity, customer trust and the ability to grow. As organisations become more digitally connected, even routine vulnerabilities can expose businesses to significant risks. 

“The priority must shift from reacting to threats to embedding security into everyday operations through strong access controls, regular assessments and clear incident response mechanisms. With hybrid work and distributed teams expanding the digital ecosystem, employee awareness becomes just as important as technological safeguards. Ultimately, cyber resilience is built when security becomes an organisational mindset, rather than the responsibility of IT teams alone,” Kumar said.

Yuval Wollman, President, CyberProof- a UST company highlights that cyber resilience requires a combination of the right technology, continuous monitoring, collaboration and regular preparedness exercises. Businesses that make cybersecurity an ongoing priority will be better equipped to manage risks, protect customer trust, and maintain business continuity in an increasingly connected world.

“I expect consolidation to continue, with enterprises moving from many point tools toward

platforms that unify exposure and risk visibility. Continuous exposure management will matter more as attack timelines shorten and threat landscape widens. Agentic AI will need governance as a standard practice, not an afterthought. And I believe India can become a genuine cybersecurity innovation hub, not only a delivery base, because the talent and the problem complexity are as strong here as anywhere in the world,” Desai said.