EY Global Information Security Survey India edition 2021

Today, no industry is safe or spared from attacks. Each sector such as manufacturing, energy, retail, professional services, government, healthcare, media, transport, education, etc. has been a victim of cyberattacks.

Over the last year, threat actors have increasingly adopted new strategies, whether by targeting businesses with phishing campaigns, by embedding backdoor codes that enable exploiting commercial software, targeting newer vulnerabilities in the areas of procurement or exploiting the ever—evolving supply chain which quickly moved from a physical supply chain to software supply chain and eventually to a digital supply chain. Attackers are targeting a growing attack surface area and their tactics are increasingly getting more and more unpredictable.

Yet, CISOs are struggling to make themselves heard. Most respondents (46%) admit that cybersecurity teams are not consulted, or are consulted too late, when leadership makes urgent strategic decisions. Whilst some maintain that this happens ‘not very often’, it only needs to happen once for a flaw in the defenses to be exploited by threat actors.

1.  Today’s cybersecurity organization is overwhelmed and underfunded

Despite the need for agility, given the volatility of the pandemic era and the possibility of future disruptions, survey data indicate that budget allocation processes remain largely rigid. Most of the respondents throughout India believe that cybersecurity expenses are not factored adequately into the cost of strategic investments and most Indian respondents agree with this scenario. As a result, even though the amount of cybersecurity investment in India is higher, there is still a need for organizations to strategically invest in the cybersecurity function.

69% of respondents are of the opinion that their annual spend on cybersecurity is below US$500,000.

Nearly 7 out of 10 (67%) CISOs surveyed believe that their budget is lower than what they needed to manage the cyber—related challenges that have emerged in the last 12 months. According to market analysts, India's cybersecurity services industry is projected to grow from US$4.3 billion in 2020 to US$7.6 billion in 2022. It is estimated that the market size for data security in India will be US$13.6 billion by 2025, and it will grow at 21% per year^[1].

Whilst organizations are realizing the importance of cybersecurity, their budgets need to be restructured to reinforce their cyber defense. Additionally, cybersecurity budgets should be factored adequately into the cost of strategic investment and should drive business objectives.

2.  Regulatory fragmentation: a challenge for CISOs?

Privacy and security regulations demand more from CISOs than ever before. Global businesses operating in multiple jurisdictions are under additional pressure due to fragmentation of regulation.

Compliance is one of the most stressful aspects of their jobs for approximately three out of five (60%) respondents, and approximately 61% expect regulations to become even more fragmented and time—consuming in the future.

“The Indian compliance environment is becoming more complex, with organizations operating National and International levels, with silos, overlaps and massive amount of being generated by Indian citizens. The regulatory and legal requirements are bound to get more explicit and stringent basis various industry/sector,” reflects Vidur Gupta, EY India Cybersecurity Partner.

3.  Deteriorating relationship between CISOs and other leaders

CISOs have always worried about weak relationships, but the GISS suggests the problem is becoming more pronounced. According to the study, business leaders are not considering cybersecurity during important conversations.

How should CISOs respond to the core challenges outlined in this year’s GISS? CISOs must be available to different departments and remain ahead of the curve in an ever-changing threat landscape, across all areas of cybersecurity. Their relationship with the Board must shift from ‘informing the Board’ to ‘educating the Board’ and eventually ‘leading the Board‘ on cyber risk program, its maturity and way ahead.

“It is of paramount importance that the cybersecurity function is supported by the Board as a trusted enabler for transformation and growth,” says Kartik Shinde, EY India Cybersecurity Partner.

Beyond the storm: future of cybersecurity

Whilst CISOs have risen to the challenge and can today demonstrate the growing strategic importance of their role, the crisis has certainly provided an opportunity. CISOs can leverage this opportunity to accelerate their efforts to address new age constructs.

Although it is not a direct or straightforward initiative, it is an ambitious objective that can be reached within a year, and this is the time when cybersecurity has been given prominence like never before, especially in India. For strategies, investments, and priorities, CISOs must be involved with the business. It is the time for them to secure a seat at the table, whilst continuing to build stronger, trust-based relationships with their C-suite peers.