THE INVISIBLE WAR : Decoding the Cybersecurity Supercycle: Who Pays for Risk—and Who Profits from Protection?

 

BIZ MASALA  |  FORENSIC BUSINESS FEATURE

THE INVISIBLE WAR

Decoding the Cybersecurity Supercycle: Who Pays for Risk—and Who Profits from Protection?

By Murthy ASR  |  Biz Masala  |  Final Forensic Edition — 9 October 2026

THE OPENING PARADOX

Illustrative server-room image supplied by the author. It is not a photograph of a named company or a documented incident site.

Cybersecurity used to be treated as an IT expense: firewalls, antivirus licences, passwords and a specialist team somewhere outside the boardroom. That description is now inadequate. A cyber incident can stop a factory, interrupt payments, expose customer data, trigger legal obligations, disrupt a hospital, or compromise a public utility. The risk is operational, financial, reputational and—in critical infrastructure—national.

But this is not simply a story about criminals becoming more sophisticated. It is also a story about the commercial economy built to defend against them: cloud-security platforms, identity tools, threat intelligence, incident-response specialists, managed security service providers, cyber-insurance underwriters and AI-security products. The more the economy digitises, the more security becomes part of the cost of doing business.

The central Biz Masala question is therefore not whether cyber threats are rising. It is whether the expansion of risk is creating a durable, profitable security industry—and who captures that value: global software platforms, specialist Indian firms, IT services companies, insurers, or in-house teams.

FIRST, SEPARATE THREE NUMBERS THAT ARE OFTEN MIXED UP

Cybercrime damage, cybersecurity spending and cybersecurity-company revenue are different things. Cybersecurity Ventures has forecast global cybercrime costs of $10.5 trillion for 2025, rising to $12.2 trillion by 2031. These are modelled estimates, not a government-accounted total of losses actually measured and verified across every country and industry. The figure is useful as a warning about scale, but it should not be presented as an audited annual bill.

On the spending side, Gartner forecasts worldwide information-security spending of $244 billion in 2026, with 11.6% constant-currency growth. Gartner separately forecasts the market for securing AI at nearly $4.8 billion in 2027 and $7.7 billion by 2028. These figures cover different market scopes; AI security is one segment, not an extra amount that can automatically be added to every broader cybersecurity forecast.

The comparison is not $10.5 trillion of losses versus $244 billion of revenue as if one directly determines the other. Cybercrime-cost estimates may include indirect disruption and lost productivity; security-spending forecasts measure money buyers spend on products and services. The relationship is causal but not one-to-one.

Source: Gartner forecasts published in 2026. Different market scopes; not directly additive.

INDIA’S DIGITAL SCALE IS ALSO AN EXPANDING ATTACK SURFACE

India’s UPI network processed 24.51 billion transactions in August 2026, worth about ₹29.82 lakh crore, according to NPCI’s monthly statistics. The growth of instant payments, mobile banking and app-based commerce creates enormous convenience and lowers transaction friction. It also creates more identities, devices, accounts, APIs and customer-service interactions that fraudsters may try to exploit.

That does not mean UPI itself is insecure or that every scam is a technical breach. Many payment frauds exploit people and processes: fake customer-care numbers, screen-sharing requests, impersonation, mule accounts, malicious links and social engineering. A payment system can be technically resilient while users remain vulnerable to manipulation.

Forensic distinction: digital payment volume is a measure of scale, not a measure of fraud. To quantify the risk, we need comparable official data on reported frauds, losses, recovery rates, scam types and the share of cases attributable to social engineering versus technical compromise.

THE INDIAN INCIDENT CURVE

CERT-In reported 2,944,248 cybersecurity incidents in 2025, up from 2,041,360 in 2024, 1,592,917 in 2023, 1,391,457 in 2022 and 1,402,809 in 2021. The series shows a substantial increase in incidents reported to the national agency. It does not by itself measure the number of unique victims, the severity of each incident, total financial losses, or the proportion that were successful attacks.

Source: Government of India / Ministry of Home Affairs response citing CERT-In incident counts, published 24 March 2026.

THE THREE BATTLEFIELDS

1. Individuals: the industrialisation of deception

The modern consumer scam is often less about breaking encryption than breaking trust. Criminals impersonate banks, police, delivery companies, employers or relatives. Generative AI can make fake voices, images and messages more convincing, but the underlying business model remains familiar: create urgency, exploit authority, and move money before the victim can verify the request.

The economics are asymmetric. A fraudster can contact thousands of people at low cost, while each victim must make a decision in seconds. The response therefore needs more than user education: rapid transaction monitoring, account-risk signals, safe payment flows, identity verification, coordinated mule-account detection and faster complaint handling.

2. Corporations: ransomware and operational interruption

Illustrative server infrastructure. This image does not depict a known ransomware victim or a verified security operations centre.

Ransomware-as-a-Service has helped commoditise parts of the criminal toolkit. Operators can rent or affiliate with malware, negotiate extortion payments and use stolen data as leverage. The financial damage can extend beyond a ransom: downtime, incident-response fees, forensic investigations, customer notification, legal costs, regulatory scrutiny, lost orders and higher insurance premiums.

Yet the story should avoid implying every attack encrypts an entire ERP system or ends in a multimillion-dollar payout. Outcomes vary sharply by victim, backup quality, network segmentation, access controls, response readiness and whether data was exfiltrated. For many businesses, the hidden vulnerability is not a missing product but weak identity management, unpatched systems, third-party access or inadequate recovery planning.

3. Governments and critical infrastructure: strategic risk

Illustrative India-and-digital-identity graphic supplied by the author. Verify image rights and provenance before publication.

Generic server cabinets used to illustrate digital infrastructure; not evidence of a specific government facility.

Power grids, telecom networks, ports, water systems, hospitals, satellites and defence supply chains depend on complex digital and operational technology. A breach may aim at espionage, disruption, pre-positioning or coercion—not merely immediate financial gain. Attribution is difficult, and not every intrusion can responsibly be labelled state-sponsored.

The sovereign-security market includes threat intelligence, secure communications, network monitoring, incident response, industrial-control-system security and supply-chain assurance. Governments face a difficult trade-off: buy proven international products, develop domestic capabilities, or combine both while managing vendor dependency, interoperability and trust.

THE BUSINESS OPPORTUNITY—AND ITS LIMITS

Security products can benefit from recurring subscriptions, multi-year contracts and the fact that customers cannot simply switch protection off. But ‘cybersecurity’ is not one uniform high-margin business. Mature software platforms may have attractive gross margins; managed security services require skilled analysts and round-the-clock operations; consulting and incident response depend on scarce people; hardware faces manufacturing and supply-chain costs. Revenue growth does not guarantee operating profit or durable free cash flow.

The market divides into several layers:

·       Identity and access management: proving who or what is requesting access, and limiting permissions.

·       Endpoint, network and cloud security: detecting suspicious activity across devices, workloads and infrastructure.

·       Security operations and managed detection: continuous monitoring, triage and response for organisations that cannot staff a full SOC.

·       Data security and privacy: discovery, classification, encryption, access controls and compliance evidence.

·       AI security: protecting model pipelines, agents, training data, inference systems and tools from misuse, prompt injection and excessive privileges.

·       Incident response and resilience: containment, forensics, recovery, backup testing and crisis management.

·       Cyber insurance: transferring some financial risk while encouraging stronger controls; coverage and exclusions vary by policy.

Zero trust is not a single product and does not mean perimeter firewalls are obsolete. It is an architectural principle: do not grant implicit trust based only on network location; continuously verify identities, devices and context, and apply least privilege. Organisations still need network controls, backups, patching, secure configuration, employee training and incident plans.

AI is a double-edged force. It can help defenders process alerts, summarise incidents and identify anomalies. It can also lower the cost of generating convincing lures, automate reconnaissance and introduce new vulnerabilities in AI applications. The commercial winners will need to demonstrate measurable risk reduction, not simply attach an ‘AI-powered’ label to a product.

INDIA’S CYBERSECURITY ECONOMY

The domestic product ecosystem is more than a collection of service providers. The Data Security Council of India’s Cybersecurity Product Landscape Report 3.0 counted more than 400 Indian cybersecurity product companies and estimated their combined 2025 revenue at US$4.46 billion, up from US$1.05 billion in 2020. This is an industry-body estimate of product-company revenue—not the same measure as Gartner’s end-user information-security spending forecast, and not a measure of the revenue of every company headquartered in India.

Source: DSCI, Indian Cybersecurity Product Landscape Report 3.0 (December 2025): https://www.dsci.in/resource/content/indian-cybersecurity-product-landscape-report-3.0

Cybersecurity depends on skilled people as well as software. The supplied image is illustrative; identity, employer and location are unverified.

One commercial estimate from MarketsandMarkets values India’s cybersecurity market at $8.59 billion in 2025 and projects $16.86 billion by 2030, a 14.5% compound annual growth rate. Other market-research firms publish different estimates because they define the market differently—some include hardware, services and consulting more broadly than others. The figure should therefore be presented as a forecast from a named research provider, not a definitive official national account.

India has several possible routes to value creation: security operations delivered from Indian service centres; domestic software and product firms; cloud and identity security; incident response; managed security services for small and medium businesses; security testing; and exports to global enterprises. But the opportunity depends on trust, product differentiation, certifications, sales access, talent and the ability to support customers across time zones.

The workforce issue also needs precision. ISC2’s 2025 study did not publish a new single global workforce-gap estimate, explaining that skills shortages and access to specific capabilities had become more informative than a headline headcount gap. Its survey found 33% of respondents said their organisations lacked resources to staff teams adequately and 29% said they could not afford the skills needed. An often-cited ‘four million professionals short’ figure comes from earlier research and should not be described as the latest 2026 estimate.

ISC2’s September 2026 India analysis, based on 524 cybersecurity professionals in India, points to skills and retention as central concerns as AI adoption accelerates. This is a survey of practitioners, not a census of every employer. It supports a more nuanced conclusion: the challenge is not simply producing more engineering graduates; it is building hands-on capability in cloud, application security, AI risk, incident response, governance and industrial systems.

REGULATION: THE DPDP ACT IS NOT A CYBERSECURITY PRODUCT

India notified the Digital Personal Data Protection Rules in November 2025, providing the operational framework for the DPDP Act, 2023, with phased implementation. The law concerns personal-data processing, obligations and rights; it is not a blanket cybersecurity code and should not be described as imposing the same immediate duties on every organisation from a single date.

For businesses, privacy compliance and cybersecurity overlap but are not identical. Security safeguards help protect personal data; governance must also address lawful processing, notices, consent where applicable, retention, rights handling and breach response. Regulatory exposure depends on the provision, implementation timeline, entity and facts of a breach. Any penalty claim in the final story should be tied to the actual law and effective provision—not to a general assumption that every cyber incident automatically triggers the maximum penalty.

THE INSURANCE QUESTION: WHO CAN PRICE THE UNPRICED?

Cyber insurance is a market built around uncertainty. Insurers need to estimate the probability and severity of losses, but cyber risk is correlated: a common software vulnerability or service-provider outage can affect many policyholders at once. Policy exclusions, sub-limits, incident-response requirements and coverage disputes matter as much as the headline premium.

Insurance cannot replace prevention. It may finance eligible response costs and some covered losses, but it cannot restore lost trust, reverse leaked data or guarantee that a business resumes quickly. The market’s development depends on better loss data, consistent incident reporting, credible controls and clarity about what policies cover.

THE HIDDEN ECONOMICS: PREVENTION VERSUS RECOVERY

The board-level calculation is not ‘security costs money, so how little can we spend?’ It is the expected cost of a disruption compared with the cost of reducing its probability and impact. The calculation is difficult because cyber events are uncertain, indirect losses are hard to estimate, and a control that prevents one type of attack may not stop another.

For smaller businesses, the practical choice may be between an in-house security team they cannot afford and a managed service that spreads monitoring costs across many customers. That creates an opportunity for MSSPs—but also a responsibility to demonstrate response quality, service-level commitments, data handling and independence. Outsourcing security does not outsource accountability.

WHAT WE SHOULD NOT CLAIM

·       Do not present the $10.5 trillion cybercrime-cost estimate as audited global losses; identify it as a forecast by Cybersecurity Ventures.

·       Do not claim a universal $500 billion cybersecurity market by 2030 without specifying the research provider, scope and year. Gartner’s information-security spending forecast is a clearer baseline.

·       Do not describe the old four-million workforce gap as the latest global estimate; ISC2 changed its reporting approach in 2025.

·       Do not imply that every UPI fraud is a UPI system breach. Social engineering and account manipulation are distinct from infrastructure compromise.

·       Do not say zero trust makes firewalls obsolete; it changes trust and access architecture.

·       Do not suggest the DPDP Act automatically imposes the same obligations or maximum penalty in every incident.

THE BIZ MASALA THESIS

Cybersecurity is becoming a structural cost of the digital economy—and a major market in its own right. But the winners will not necessarily be the firms with the loudest threat claims or the biggest addressable-market slide. They will be the companies that can prove risk reduction, respond quickly, integrate across complex systems and price services that customers can sustain.

For India, the opportunity is double-sided: protect an enormous digital economy while building exportable products, managed services and specialist talent. The risk is that rising demand is captured mainly by global vendors, while domestic providers remain concentrated in lower-value services—or that organisations buy tools without fixing identity, recovery, governance and operating discipline.

The decisive question is not whether cyber risk will remain. It is who will pay to reduce it, who can demonstrate that the spending works, and who captures the recurring revenue as security becomes part of the infrastructure of every digital business.

SOURCES AND DATA NOTES

·       Gartner, India information-security spending forecast: $3.435 billion in 2026, up 11.7%: https://www.gartner.com/en/newsroom/press-releases/2026-03-09-gartner-forecasts-information-security-spending-in-india-to-total-3-billion-us-dollars-in-2026

·       Data Security Council of India, Indian Cybersecurity Product Landscape Report 3.0: 400+ product companies; 2025 revenue estimated at $4.46 billion, projected around $6 billion in 2026: https://www.dsci.in/files/content/press-release/2026/Press-Release_Indian-Cybersecurity-Product-Landscape-3.0-Dec-25.pdf

·       CERT-In, Digital Threat Report 2025–26, published 13 July 2026: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBWEL03

·       Gartner, Forecast Analysis: Information Security, Worldwide, 2026 (published 5 February 2026): https://www.gartner.com/en/documents/7408930

·       Gartner, AI security market forecast (26 August 2026): https://www.gartner.com/en/newsroom/press-releases/2026-08-26-gartner-forecasts-the-market-for-securing-ai-will-reach-almost-5-billion-in-2027

·       Cybersecurity Ventures, 2025 cybercrime cost forecast and methodology note: https://cybersecurityventures.com/official-cybercrime-report-2025/

·       NPCI, UPI product statistics (August 2026): https://www.npci.org.in/product/upi/product-statistics

·       Government of India / PIB, CERT-In reported cybersecurity incidents, 24 March 2026: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2244504&lang=2&reg=48

·       MarketsandMarkets, India Cybersecurity Market (2025–2030), published August 2026: https://www.marketsandmarkets.com/Market-Reports/geography/cyber-security-market/india

·       ISC2, 2025 Cybersecurity Workforce Study (4 December 2025): https://www.isc2.org/insights/2025/12/isc2-publishes-2025-cybersecurity-workforce-study

·       ISC2, India cybersecurity workforce analysis (24 September 2026): https://www.isc2.org/Insights/2026/09/research-india-cybersecurity-workforce-reaches-a-turning-point-skills-ai

·       MeitY, Digital Personal Data Protection Rules 2025 and enforcement timeline: https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa?pageTitle=Digit

·       US Trade Administration, India Cybersecurity Market Intelligence: https://www.trade.gov/market-intelligence/india-cybersecurity

 

 

VISUAL RIGHTS AND PROVENANCE: Images supplied by the author are used illustratively and do not identify a verified incident, data centre, company or government facility. The watermarked Shutterstock graphic was excluded. Confirm publication rights and provenance for all supplied images before public release.

 

BIZ MASALA

Business. Economics. The story behind the numbers.

Murthy ASR  |  Independent analysis