India Processes One-Third of the World's Security Alerts. Why Does It Still Import Its Security Thinking?
India runs a large share of the world's security operations, yet imports the intelligence and frameworks behind them. Why operational scale has not become intelligence ownership, and what that leaves open for Indian companies to build.
Summary
- Indian IT services firms run 24/7 security operations for global clients, yet the threat intelligence, platforms and frameworks their analysts use are largely imported.
- The telemetry these operations generate could power India-first threat intelligence, but client contracts and a billable-hours model discourage retaining and productising it.
- Relying on intelligence built for other threat environments leaves Indian institutions under-defended against local attacks such as UPI phishing and Aadhaar-related fraud.
India runs the world's cybersecurity operations. But the intelligence that drives them comes from somewhere else entirely.
Every night, tens of thousands of Indian security analysts monitor the digital infrastructure of American hospitals, British banks, Australian retailers, and German manufacturers. They work from delivery centres across Bengaluru, Hyderabad, Chennai, and Pune, where they triage alerts, investigate anomalies, write incident reports, and escalate threats. They are, by any reasonable measure, the operational backbone of global cybersecurity.
India's IT services companies collectively employ more security professionals than most countries have in total. TCS, Infosys, Wipro, HCLTech, and Tech Mahindra run 24/7 security operations centres that process millions of security events daily for clients across North America, Europe, and Asia-Pacific. India is the world's largest exporter of cybersecurity services by headcount and delivery volume.
Yet the tools and thinking behind that work are largely imported.
The threat intelligence those analysts use comes from Recorded Future, a US company. The detection platform comes from CrowdStrike or Palo Alto Networks, both American. The frameworks come from MITRE ATT&CK, built in Virginia. The playbooks are adapted from NIST guidelines, written in Maryland. The AI models that triage the alerts were trained on threat data collected primarily from North American and European enterprise networks.
India processes the alerts. Someone else decides what they mean.
Why India has the data and still imports the thinking
The raw material for world-class threat intelligence is incident data, more than capital or technology. Incident data shows what attacks look like in practice, how they propagate, what they target, and how they evolve. India processes security events for hundreds of global clients across thousands of enterprise networks. So it sits on one of the largest repositories of real-world threat telemetry on the planet.
Every phishing email that a TCS security analyst triages is a data point. So is every ransomware alert that a Wipro SOC analyst investigates, and every anomalous login pattern that an Infosys threat hunter examines. Aggregated across millions of events, thousands of clients and years of operations, this telemetry is the foundation of the most accurate possible picture of how attackers behave.
Indian IT services companies are generating the data that could power world-class threat intelligence. They are not systematically converting it into a product. The data is being processed and discarded rather than retained, enriched, and monetised.
The reasons are partly contractual. Client data belongs to the client, and most MSSP agreements include provisions that prevent vendors from using client security data for any purpose other than delivering the contracted service. The structural barrier is strategic as well as legal. The dominant business model of Indian IT services is billable hours and FTE contracts. Investing in proprietary intelligence platforms requires R&D spend that reduces short-term margin without an immediate billable return. The incentive structure of the industry actively discourages the investment that would allow India to convert its operational scale into intellectual capital.
What India-specific threat intelligence would look like
India faces threats with characteristics that global platforms built primarily on North American and European data systematically under-serve. Consider the attack vectors that are most prevalent in India:
• UPI-linked phishing and social engineering that exploits the specific interface conventions of BHIM, GPay, PhonePe, and Paytm in ways that no Western threat intelligence feed captures with precision. • Aadhaar-related identity fraud that exploits the specific architecture of India's digital identity infrastructure, including OTP interception, biometric bypass, and demographic data exploitation. • APT campaigns targeting Indian defence supply chains, using Hindi-language spearphishing and using the specific procurement workflows of DRDO and defence ministry contractors. • State-sponsored intrusion attempts targeting Indian critical infrastructure: power grid SCADA systems, railway management platforms, and telecom backbone providers, each with India-specific attack surface characteristics.
A threat intelligence platform trained specifically on Indian threat data would detect these attack patterns faster than any global platform can. Its detection would also be more accurate, with lower false positive rates. It would know that a particular phishing template targets Indian BFSI clients, not generic banking customers. It would recognise the specific payload signatures associated with threat actors who target Indian government systems.
This platform does not exist at scale. SAFE Security has built a risk quantification layer. Innefu Labs has built government-facing intelligence tools. Seqrite has built endpoint detection models that perform well on locally prevalent malware families. These are early signals of what Indian threat intelligence could become. None has yet built the comprehensive, telemetry-driven, India-first threat intelligence platform that the country's operational scale could support.
Why this matters beyond market size
Importing security thinking is a missed commercial opportunity and a strategic vulnerability.
India's critical infrastructure operators, BFSI institutions, and government agencies face this risk directly. When they make cybersecurity decisions based on threat intelligence frameworks built for a different threat environment, they systematically under-invest in the defences that matter most for their exposure.
The AIIMS Delhi ransomware attack of 2022 compromised approximately 40 million patient records and disrupted services for nearly two weeks. The attack vector was not novel. The specific combination of vulnerabilities exploited, the propagation method, and the ransomware variant used were all known to global threat intelligence platforms. But the specific configuration of AIIMS's network, the third-party access pathways, and the social engineering approach used were tailored to the Indian healthcare context. Global intelligence had not pre-mapped them. A domestic threat intelligence capability would have, because its analysts would be working with data from the right environment.
India has made this jump before, in pharma and IT services
India is at an inflection point in cybersecurity that it has been at before in adjacent industries. The country built a world-class pharmaceutical generics manufacturing base by combining scale, cost efficiency, and regulatory capability. It built a world-class IT services industry by combining English-language capability, technical education, and time-zone advantage. In both cases, India started as a low-cost executor of other people's intellectual frameworks. It then progressively built enough proprietary capability to compete on the value of what it knew, not just the cost of what it did.
Cybersecurity is the next iteration of this pattern. The operational scale and the talent are already there, and the threat data is being generated at scale every night. What is missing is the strategic decision to treat that data as an asset rather than a by-product of service delivery.
The company that builds a genuinely India-first threat intelligence platform will have a moat no foreign vendor can replicate, regardless of their technology or capital. That platform would be trained on Indian threat telemetry, sold to Indian enterprises and exported to global markets with India-specific differentiation.
India runs the world's cybersecurity operations. The moment it starts thinking for them too, where value sits in the industry changes permanently.
How useful was this article?
One tap. It tells us what to write more of.
About the author
SRF Capital Studio
The next one
Get what we publish next, by email.
Working notes on raising, borrowing, protecting, growing and structuring capital in India. One email a week at most, and you can leave any time.
We use your address only to send this. See our privacy policy.
We store your address to send you these emails and nothing else. See our privacy policy.
The services behind this article
What we do about it, for founders and finance teams. Each has its own page.
Market Intelligence
A continuous read on the sector: what is moving capital, regulation and demand, and what it means for this business.
