An Indian breach costs ₹25.5 crore on average; CERT-In’s caseload has grown 2.5×

01CERT-In’s caseload grew two and a half times in five years

The only official Indian count is CERT-In’s. Answering in the Rajya Sabha in February 2025, the Minister of State for Electronics and IT gave the incidents CERT-In recorded each year: 11,58,208 in 2020, 14,02,809 in 2021, 13,91,457 in 2022, 15,92,917 in 2023 and 20,41,360 in 2024.¹ A government statement in January 2026 added 2025: over 29.44 lakh incidents handled, with 1,530 alerts and 390 vulnerability notes issued.²

Read the count for what it is. An “incident” to CERT-In includes a defaced website, a phishing domain and a scan that was reported, not only a breach, and part of any rise is better reporting since the 2022 Directions made reporting compulsory. But the six-hour reporting rule has been in force since June 2022, so the jump from 2024 to 2025 is not a reporting-rule effect.⁸

The one sector breakdown CERT-In has published shows how much of the count is noise and how much is not. In an August 2026 Rajya Sabha reply, banking accounted for 5,70,108 incidents in 2025 and 3,48,607 in the first half of 2026; healthcare for 34,480 and 18,855. Of the finance-sector incidents, 4,70,445 in 2025 were malicious scanning and probing, and 39 were targeted intrusion campaigns against banks.¹³ Most of the volume is someone knocking. The 39 are someone who got in and stayed, and those are the ones the next section prices.

02A breach in India now averages ₹25.5 crore

IBM’s Cost of a Data Breach study, released in India on 3 August 2026, put the average total cost of a breach for an Indian organisation at ₹25.5 crore, an all-time high and 15.9% above the ₹22 crore of the 2025 study, which was itself 13% above 2024’s ₹19.5 crore.^{3 4} Financial services paid most at ₹40.9 crore, then technology at ₹35.7 crore and communications at ₹34.5 crore. The average breach exposed 39,500 records, up from 38,200 a year earlier.³

Speed is the other lever IBM measures. Organisations with no security AI or automation took 236 days to identify a breach and 75 to contain it, 311 in all; those using it extensively took 175 and 81, or 256.³ Fifty-five days is the gap between finding the intruder in the third quarter and finding them in the second.

The shadow-AI line deserves a sentence of its own because it is new and cheap to fix. ₹1.79 crore is what IBM attributes, on average, to breaches at organisations where staff used AI tools the company had not sanctioned, IBM’s “shadow AI”.³ The control is an approved tool and a policy that says so, not a new security platform.

03Where Indian breaches start, and what employees can stop

IBM records the first way in. For India in 2026 the top three were phishing, including voice and SMS phishing, at 19%; drive-by compromise, where a user visits a compromised or malicious site, at 16%; and supply-chain compromise at 15%.³ The 2025 study had phishing at 18%, third-party and supply-chain compromise at 17% and vulnerability exploitation at 13%.⁴

The implication is uncomfortable for the habit-based approach. About one breach in seven in IBM’s Indian data starts at a supplier, and no amount of staff training reaches a supplier’s build server. Drive-by compromise is mostly a patching and browser-isolation problem that sits with IT, not with the person who clicked.

The year-on-year change points the same way. In the 2025 study, vulnerability exploitation was the third vector at 13%; in 2026 it left the top three and drive-by compromise entered at 16%.^{4 3} Supplier compromise held near one in six both years. Two consecutive Indian studies, in other words, put the vendor relationship and the unpatched endpoint level with the phishing email.

04Half the 2023 checklist has aged, and two items are now wrong

The 2023 list told staff to use passwords of at least 12 characters mixing upper and lower case, numbers and symbols, and to change them regularly. NIST’s revised digital identity guideline, SP 800-63B revision 4 (August 2025), now says verifiers “SHALL NOT require subscribers to change passwords periodically” and “SHALL NOT impose other composition rules”, and sets 15 characters as the minimum for a password used on its own.⁵ Forced rotation produces Summer2026!; length and a second factor do not.

What survives is the instinct behind the list: report what looks wrong, and treat security as a business cost. What changes is who carries it. The controls that address the three leading Indian vectors, MFA, patching and supplier access, are bought and run by the company. Training is still worth paying for. It is not the first line of the budget.

For a business funding this from scratch, we would sequence it like this, each line tied to a number above:

1. MFA on email, VPN and every admin console. It blunts the 19% that starts with phishing even when the training fails.
2. Patch browsers and internet-facing systems on a clock. The 16% drive-by vector and 2025’s 13% exploitation figure are the same discipline.
3. A supplier register with access reviews. Know which vendors can reach your systems and remove the ones that no longer need to; this is the 15%.
4. Endpoint protection and 180 days of logs. The first finds the intruder sooner; the second is what CERT-In requires and what you need to answer “where else?”
5. Then training, focused on reporting rather than memorising rules.