At a moment of stagnation and political drift, Andy Burnham’s push for a new plan suggests the centre-left debate has moved beyond Downing Street

Once a political leader’s net favourability sinks deep into negative territory, recovery is the exception, not the rule. It usually takes an economic rebound, a dramatic political reset or an opposition implosion to reverse the slide. Sir Keir Starmer’s personal ratings are in a danger zone from which few escape.

Yet the prime minister, like the Bourbons, has learnt nothing and forgotten nothing. He made a speech this week after coming close to being ousted suggesting he would “fight” on. He doubled down in parliament despite glaring errors in judgment. He forced out his cabinet secretary while his own failures remain unaddressed. He seemed to blame everyone but himself. When support slips and a leader answers with defiance, voters don’t see strength – they see denial.

Do you have an opinion on the issues raised in this article? If you would like to submit a response of up to 300 words by email to be considered for publication in our letters section, please click here.

Continue reading...

© Photograph: Adam Vaughan/EPA

© Photograph: Adam Vaughan/EPA

© Photograph: Adam Vaughan/EPA

With just seven weeks before its funding runs out, the UK’s greatest cultural asset and most trusted international news organisation must be supported

“The programmes will neither be very interesting nor very good,” said the then BBC director general John Reith, when he launched its Empire Service in December 1932. Nearly a century later, the BBC World Service, as it is now known, broadcasts in 43 languages, reaches 313 million people a week and is one of the UK’s most influential cultural assets. It is also a lifeline for millions. “Perhaps Britain’s greatest gift to the world” in the 20th century, as Kofi Annan, the former UN secretary general, once put it.

But this week Tim Davie, the corporation’s director general, announced that the World Service will run out of funding in just seven weeks. Most of its £400m budget comes from the licence fee, although the Foreign Office – which funded it entirely until 2014 – contributed £137m in the last year. The funding arrangement with the Foreign Office finishes at the end of March. There is no plan for what happens next.

Do you have an opinion on the issues raised in this article? If you would like to submit a response of up to 300 words by email to be considered for publication in our letters section, please click here.

Continue reading...

© Photograph: Lewis Whyld/PA Wire/Press Association Images

© Photograph: Lewis Whyld/PA Wire/Press Association Images

© Photograph: Lewis Whyld/PA Wire/Press Association Images

Comments on the ‘colonisation of the UK’ by the co-owner of Manchester United were erroneous, crass and a gift to divisive forces in British society

In 2020, the year Sir Jim Ratcliffe moved his huge fortune to Monaco, migrants in the United Kingdom made tax contributions estimated to be worth around £20bn. Sir Jim, by jetting off to a tax haven on the French Riviera, saved himself an estimated £4bn. It took some brass neck for the expat owner of Ineos and co-owner of Manchester United football club to lecture the country, using inflammatory and offensive language, on the perils of immigration.

Where to begin? The statistics used by Sir Jim to back his claim that Britain was being “colonised” by migrants, in an interview with Sky News, were flatly wrong. They were also astonishingly crass, coming from a man who presides over a sporting institution famous for and proud of its global fanbase and international connections.

Do you have an opinion on the issues raised in this article? If you would like to submit a response of up to 300 words by email to be considered for publication in our letters section, please click here.

Continue reading...

© Photograph: Nicolò Campo/LightRocket/Getty Images

© Photograph: Nicolò Campo/LightRocket/Getty Images

© Photograph: Nicolò Campo/LightRocket/Getty Images

A campaign of ethnic cleansing and ‘tectonic’ new legal measures are killing the two-state solution to which other governments pay lip service

Protecting archaeological sites. Preventing water theft. The streamlining of land purchases. If anyone doubted the real purpose of the motley collection of new administrative and enforcement measures for the illegally occupied West Bank, Israel’s defence minister spelt it out: “We will continue to kill the idea of a Palestinian state,” Israel Katz said in a joint statement with the finance minister, Bezalel Smotrich.

While the world’s attention was fixed upon the annihilation in Gaza, settlers in the West Bank intensified their campaign of ethnic cleansing. More than 1,000 Palestinians have been killed there since October 2023; a fifth of them were children. Many more have been driven from their homes by relentless harassment and the destruction of infrastructure, with entire Palestinian communities erased across vast swathes of land.

Do you have an opinion on the issues raised in this article? If you would like to submit a response of up to 300 words by email to be considered for publication in our letters section, please click here.

Continue reading...

© Photograph: Anadolu/Getty Images

© Photograph: Anadolu/Getty Images

© Photograph: Anadolu/Getty Images

When a CEO's deepfake appears in a fraudulent investor call, when stolen credentials surface on dark web marketplaces, or when executive impersonation attempts trick employees into wire transfers, the damage isn't just technical—it's existential. Yet most organizations treat executive protection as an afterthought, if they think about it at all, instead of leveraging Executive Monitoring Platforms to detect and mitigate these threats proactively. Here's the uncomfortable reality; your executives aren't just high-value employees. They're walking attack vectors. Their social media presence, their public speaking engagements, their digital footprints across platforms—all of it creates opportunities for threat actors. And unlike technical vulnerabilities that can be patched, executive exposure is permanent, cumulative, and growing by the day. Executives understand visibility as a business necessity for leadership, brand building, and investor confidence. What they often lack is executive security intelligence that shows how attackers weaponize that visibility. The question isn't whether your leadership team needs executive monitoring. It's whether you can afford not to have it.

The Executive Blind Spot Nobody Talks About

Traditional security frameworks focus on perimeter defense, endpoint protection, and network monitoring. Executive monitoring exists in a different dimension entirely—one that bridges digital risk, physical security, and reputational management in ways most security teams aren't equipped to handle. Consider what attackers see when they target executives: comprehensive LinkedIn profiles detailing career histories and professional networks, conference schedules announcing travel plans weeks in advance, published interviews revealing decision-making processes and strategic priorities, social media posts exposing family members and personal interests, and professional email addresses easily harvested for spear-phishing campaigns. This isn't reconnaissance requiring sophisticated hacking. It's open-source intelligence gathering anyone can perform in an afternoon. The real vulnerability is that executives themselves rarely understand their exposure. They view public visibility as part of the job—necessary for thought leadership, investor relations, and business development. They're not wrong. But they're also not thinking like attackers.

Why Executive Threats Are Business Continuity Issues

A compromised server gets fixed. A breached database gets contained. But when executives become attack targets, the damage radiates through the organization in ways that don't show up in incident reports. Business email compromise attacks targeting executives cost organizations an average of $4.1 million per incident. That's not counting the reputational damage, the eroded stakeholder trust, or the board-level questions about why leadership wasn't better protected. Deepfake technology has matured to the point where realistic video and audio impersonations can be generated in hours, not days. When a fake CEO video circulates making false claims about company performance, markets react before PR teams can even draft responses. Executive credential leaks create cascading risks. Unlike typical employee accounts, executive credentials often have elevated privileges, access to sensitive strategic information, and the authority to approve high-value transactions. A single compromised executive account can become the fulcrum for devastating attacks. This is where standard security tools fall short. They protect infrastructure—but they don’t deliver real-time executive protection. They don’t monitor the dark web for leaked executive credentials, track impersonation accounts on social platforms, or identify deepfakes before they go viral. That gap is precisely what executive monitoring solutions are designed to fill.

Interested in exploring how executive monitoring can strengthen your leadership protection and enable strategic growth? Learn more about comprehensive executive threat intelligence solutions at Cyble.com.

The Growth Multiplier Effect

Here's the business case that gets overlooked in security discussions; executive monitoring doesn't just prevent damage—it enables growth. When leaders can engage publicly with confidence, thought leadership accelerates. When executives travel internationally backed by executive protection services, deal-making and partnerships move faster. When boards know that leadership exposure is continuously monitored, governance concerns diminish and strategic focus increases. Organizations with robust executive monitoring platforms demonstrate operational maturity that resonates with investors, partners, and enterprise clients. It signals that security isn't just an IT function—it's embedded in how the business operates at the highest levels. For companies pursuing M&A activity, executive protection becomes due diligence table stakes. Acquiring companies want assurance that leadership teams come without hidden security liabilities. The velocity of business decisions improves when executives aren't second-guessing their digital exposure. Strategic communications happen more freely. Competitive intelligence can be gathered more aggressively. Innovation discussions occur with less fear of leakage.

What Effective Executive Monitoring Actually Looks Like

The difference between security theater and genuine protection is specificity. Generic threat intelligence doesn't translate to executive protection. What matters is real-time monitoring across the specific vectors where executive threats emerge. Effective platforms monitor dark web forums and cybercrime marketplaces for executive PII leaks, tracking when credentials, personal data, or sensitive information surfaces in underground channels. They deploy AI-driven deepfake detection across social media and video platforms, identifying manipulated content before it gains distribution. Social media impersonation tracking identifies fake accounts masquerading as executives, often used for business email compromise setup. Compromised credential monitoring alerts when executive email addresses or passwords appear in breach databases, enabling immediate password resets before exploitation. The challenge is scale and speed. Manual monitoring can't keep pace with how quickly threats emerge and spread. By the time a security analyst discovers an executive impersonation account, it may have already been used to contact employees or partners. This is where platforms like Cyble's Executive Monitoring solution demonstrate the value of automation paired with human expertise. Cyble delivers real-time executive protection across the surface web, deep web, and dark web. The platform combines real-time alerts delivered via email, SMS, or WhatsApp with AI-powered threat detection that identifies deepfakes, impersonations, and credential leaks across surface web, deep web, and dark web sources. It provides unified dashboard visibility that consolidates executive threats into a single view rather than fragmenting them across multiple tools, and integrates physical security intelligence for executives traveling to high-risk locations with contextualized threat assessments. What separates effective solutions from basic monitoring is context. Alerting about every potential threat creates noise. Understanding which threats pose genuine risk to specific executives based on their role, public profile, and current activities—that's intelligence. Cyble's approach emphasizes actionable insights over data dumps. When an executive's credentials appear in a breach, the platform doesn't just alert—it provides context about the source, potential impact, and recommended response actions. When deepfakes are detected, automated takedown processes can be initiated, removing fraudulent content before it spreads widely.

Also read: How Cyble is Leading the Fight Against Deepfakes with Real-Time Detection & Takedowns

Instead of flooding teams with noise, Cyble provides insight into severity, relevance, and recommended actions—turning raw data into Executive Security Intelligence.

The ROI Nobody Calculates

Traditional security investments justify themselves through prevented breaches and avoided downtime. Executive monitoring ROI is harder to quantify precisely because it's impossible to measure attacks that never happened due to deterrence and early intervention. But consider the inverse calculation: what's the cost of not having it? A single successful executive impersonation attack costs millions. A leaked executive credential that enables a broader breach amplifies damage exponentially. A deepfake crisis that damages brand reputation takes years to repair. The question shifts from "can we justify the investment" to "can we justify the exposure." Organizations serious about growth recognize that executive security is growth infrastructure, not a cost center. It's the same logic that drives investments in executive coaching, strategic advisors, and leadership development. You're protecting and amplifying the most valuable assets in the organization—the people making decisions.

Building Protection That Scales With Ambition

The final insight that separates mature organizations from reactive ones is that executive monitoring isn't static. As companies grow, executive profiles rise. As leadership becomes more publicly visible, attack surfaces expand. As strategic importance increases, threat actor interest intensifies. Effective senior executive threat protection must scale alongside ambition. Scalable executive protection means platforms that grow with organizational complexity, handling increased numbers of monitored executives as leadership teams expand. They adapt to evolving threat vectors, continuously updating detection capabilities as attack techniques mature. They integrate with existing security infrastructure rather than creating isolated silos, and provide graduated protection levels matching executive risk profiles rather than one-size-fits-all approaches. This requires platforms built on threat intelligence foundations, not bolt-on features added to existing security suites. Cyble's Executive Monitoring exists within a broader threat intelligence ecosystem that includes dark web monitoring, brand protection, and attack surface management. This integration means executive threats aren't isolated signals—they're correlated with broader organizational risk patterns. When an executive's name appears in dark web discussions alongside mentions of your company's infrastructure, that correlation matters. When brand impersonation campaigns coincide with executive travel to specific regions, that context informs protective measures.

The Strategic Imperative

Executive monitoring represents a fundamental shift in how organizations think about security. It acknowledges that protecting infrastructure isn't enough when people are targets. It recognizes that reputational risk and operational risk intertwine at the leadership level. It accepts that digital threats demand digital surveillance, not just digital defenses. For organizations pursuing growth, executive protection isn't optional anymore. It's foundational. The businesses that will dominate their markets in the coming decade aren't just those with the best products or strongest financials—they're the ones whose leadership can operate with confidence, visibility, and strategic aggression because their digital exposure is being actively managed. The threat landscape has evolved. Executive protection must evolve with it. The question is whether your organization will adapt proactively or learn these lessons the expensive way.

Interested in exploring how executive monitoring can strengthen your leadership protection and enable strategic growth? Learn more about comprehensive executive threat intelligence solutions at Cyble.com.

By Vijender Yadav, CEO & Co-founder, Accops  The cybersecurity industry is currently grappling with a paradox: encryption, compliance, and spending are at record highs, yet data privacy remains fragile. This stems from a reliance on a 2021 playbook to fight a 2026 war.  Historically, data protection was a static discipline focused on "data at rest" and "data in transit." However, in an era where automated discovery tools can map an enterprise's entire data footprint in minutes, traditional walls have become irrelevant. The perimeter has shifted; it no longer resides at the edge of the network, but at the precise moment of access. 

The Death of the "Safe" Zone 

By now, the concept of a "trusted network" is an architectural relic. In 2026, data is a fluid asset distributed across multi-region SaaS, edge computing nodes, and sovereign clouds rather than sitting in a central vault.  The primary challenge today is the "Identity-Data Gap." While the transition away from the physical office is complete, the assumption of trust associated with it often remains. If a user connects to a resource, legacy systems frequently grant broad, persistent visibility. This level of exposure facilitates near-instant lateral movement across the network and connected devices, making such visibility a direct threat to data privacy.  Protecting data privacy in this environment requires a shift from storage-centric security to visibility control. Resources must remain "dark" to everyone except the authenticated, authorised user throughout a continuously verified session. 

Data Privacy Week 2026: Defending Against the "Identity Hijack" 

In 2026, the primary threat to data privacy is the weaponisation of legitimate access rather than sophisticated software exploits. While a user’s identity can be verified with near-total certainty, organisations remain remarkably vulnerable to the context of that identity—specifically the what, how, and when of the access request. In this model, identity has become a false proxy for trust.  As identity remains under constant siege, secure access must move beyond a "gatekeeper" event to become a Continuous Adaptive Risk and Trust Assessment (CARTA). Securing the new perimeter requires the validation of three distinct pillars through persistent, 24/7/365 monitoring:

1. Validate the Human (Identity & Presence): Progressive organisations are adopting a multi-modal approach that combines phishing-resistant hardware verification with biometric-first identity signals. By anchoring identity in physical hardware (such as FIDO2-compliant keys) and augmenting it with continuous monitoring of liveness and presence, it is possible to ensure that the authorised individual remains physically present at the keys throughout the interaction. This layered verification prevents session hijacking or "shoulder surfing" in real-time. 

1. Validate the Device (Integrity & Posture): It is no longer safe to assume a device is secure simply because it is corporate-owned. The technical integrity of the endpoint must be evaluated before and during access. This involves continuous checks for managed status, OS vulnerabilities, and security software health to ensure the tool used to access data is not a compromised gateway. 

1. Validate the Behaviour (Intent & Monitoring): This final layer of the perimeter involves monitoring user actions for deviations from established norms. Detecting anomalies in navigation speed, timing, and data consumption allows for an assessment of whether a device is acting like a human-operated workstation or an automated exfiltration bot. The perimeter thus functions as a dynamic response system that adapts based on 'Contextual Intelligence'—the real-time risk of the intent. 

Privacy-First Architecture: Micro-Segmentation of Access 

The defining transition for 2026 and beyond is the shift from "Access to Resources" to "Entitlement within Resources."  Under a Zero Trust Network Access (ZTNA) 2.0 framework, this is achieved through a "Privacy of Exclusion" model. Connecting a user to an application is no longer sufficient; granular actions within that application must be managed. By default, no user sees any data. Only when a specific request is validated is a "one-to-one" encrypted tunnel created, restricting the user to the precise dataset required for the task.  This approach is necessary to satisfy the rigorous "Need-to-Know" requirements of global regulations like the GDPR or India’s DPDPA. Data privacy cannot be maintained if a network architecture allows a marketing executive to even ping an HR database. Secure access enforces privacy by making the unauthorised invisible. 

Looking Ahead: The Invisible Perimeter 

The mandate for technology leaders is to de-couple security from the underlying infrastructure of the internet.  Data privacy is not a checkbox; it is a continuous state of being. It is maintained only when access is granular, just-in-time, and verified with every single click. The "Castle and Moat" has been replaced by an invisible guard made of identity and intent—ensuring that privacy is a default setting rather than a manual effort. 

By Suresh Kanniappan, Sales Head, Infrastructure Management and Security Services, US at Happiest Minds Let’s revisit the recent ransomware attack that hit one of the biggest hospital networks in the US. The cyberattack shut down surgeries, made patients' records unavailable, and forced emergency departments to divert incoming cases. Unfortunately, this is not an isolated story. Throughout 2025, healthcare organisations have faced a growing wave of cyber threats, highlighting the urgent need for Cyber Resilience in Healthcare. The scale and precision of cyber threats have increased manifold, with impacts extending far beyond data breaches: disrupting care, delaying diagnoses, and even shaking the very foundation of patient trust.

Why has Cyber Resilience in Healthcare Become More Critical Than Ever?

The recent report released by the U.S. Department of Health and Human Services, which found that more than 133 million patient records were compromised in the first half of 2025, marking the highest number to date. More concerning is the impact of ransomware attacks, which have grown 3X, affecting everything from the electronic health record systems to connected diagnostic equipment. All these incidents have had a significant impact on human life. There were many postponed surgeries, families were afraid about what was next, and the clinicians had no access to the vital data when it was needed most. All these were not just operational challenges; they were an alarm for all healthcare systems that building a strong resilience is essential in today's highly connected digital world. What we need to understand is clear: cybersecurity in healthcare is no longer about prevention alone; it's about resilience, recovery, and readiness. So, what must the healthcare industry focus on in 2026 and beyond?

1. Zero Trust to Replace Perimeter: Zero Trust security is already in place, but how effectively it is implemented is to be verified. Zero trust will continue to be the backbone of every industry, ensuring every user, every device, and every access is verified without exception. It is not just about restricting access; it is about knowing who has access to what and granting permission to the right people for the right requirements.
2. AI will Redefine Defense: AI has become an integral part of our lives; it is re-shaping both cyber-attacks and defense. Cyber adversaries are using AI to create personalized phishing attacks, exploit unpatched devices, and steal data and credentials at a pace humans can't match. The advice for healthcare experts is to implement AI as a new defense engine, deploying AI-driven threat analytics, automated response workflows, and continuous monitoring to spot and contain threats in real time. This will help healthcare security teams protect data and clinical operations much faster and with higher precision.
3. Supply Chain Vigilance to be Stepped Up: The recent breaches over the last 1 year have not happened within the boundaries of the hospitals, but it is beyond that through third-party vendors, devices, and software. It's time for the healthcare providers to look into every vendor that enforces real-time risk monitoring, contractual accountability, and shared visibility across the entire healthcare and value chain. They need to bring strong security in place to ensure resiliency.
4. Regulations Will Drive Accountability: Global regulators are strengthening mandates around healthcare data protection, breach reporting, and AI transparency. In the coming year, leadership involvement in cybersecurity governance will need to be stronger. Boards and CXOs will need to give digital safety the same priority as patient safety. Compliance will become an ongoing practice of accountability rather than just an annual paperwork exercise. Role of the leaders

Strategic Priorities of Healthcare Leaders

1. Redefining Cyber Resilience as a Leadership Imperative: The need of the hour is resilience, and it should start from the top management itself to foster leadership commitment and shared responsibility for bringing in a positive mindset, investing in better cybersecurity tools and service providers that enable patient safety.
2. Empower People, Not Just Systems: Resilience is not built by technology; it is to be instilled within us, and human awareness is the best barrier. Each staff member, from the frontend IT administrators to nurses, is an integral part of ensuring the organization's integrity and patients' safety. Periodically conducting simulations, awareness campaigns, and real-world readiness drills will be necessary to make security a shared responsibility rather than an isolated function.
3. Establish a Culture of Collaboration: Threats don’t operate in isolation, and neither should our defense. Leaders must champion collaboration across hospitals, vendors, industry groups, and public-sector bodies. Proactive threat intelligence sharing and coordinated response frameworks enable healthcare organizations to anticipate disruptions rather than merely react. True resilience is never built in isolation; rather, it is forged through partnership.

The Way Forward: Resilience as the Heartbeat of Healthcare

Healthcare no longer remains confined to hospital premises. It has gone much beyond the walls of any hospital. Every network and every device that carries the patient's record or clinical data must be protected in today's connected world. It is more about constant trust rather than a one-time effort or technical achievement. Being resilient, even in the face of system failure, without compromising patient care, is vital. As for 2026, organizations would have to balance innovation with integrity and treat cybersecurity not just as a compliance checklist but as a shared responsibility to prioritize patient health and data. Integrating AI into cybersecurity practice will further help strengthen threat detection and response by identifying threats and containing them even before they strike. The future of health is not defined by how sophisticated AI will become but by how well it is integrated into every layer of care. Resilience will come from AI-powered systems that protect patient data, strengthen clinical operations, and make sure the promise of technology truly supports the promise of healing.

Threat hunting is no longer a reactive activity that focuses on pursuing signals after trouble has been done. The role of the threat hunter is changing as attackers become more persistent and repurpose tried-and-true methods. Proactive threat hunting is not only possible but also necessary for contemporary security systems, according to Saeed Abbasi from Qualys. Effective threat hunting in 2026 will be based on knowing how attackers act, how they repurpose techniques and how their actions leave long-lasting evidence inside surroundings rather than searching for the unknown.

Proactive Hunting Is About Patterns, Not Surprises

It's a prevalent misperception that proactive threat hunting involves recognizing previously unseen threats. Attackers rarely innovate that way in practice. They repeat themselves. Once a vulnerability is discovered, whether in a product or an advanced technology, attackers repeatedly take advantage of that entire category of software until it becomes a liability for the entire industry. When teams concentrate on adversary-centric context rather than generic risk ratings, proactive threat hunting increases. Better prioritization leads to better hunting. This involves looking at attacker telemetry and posing useful queries: Has the threat been turned into a weapon? Does it have anything to do with ransomware? How frequently has it been observed in the wild? Is there any activity or conversation about it on the dark web? Is this a target that keeps happening? Threat hunters can prevent exploitation cycles rather than only responding to them by concentrating on how attackers truly function.

Also read: Reaction isn’t defence: Why proactive threat hunting matters

Automation and AI Change the Role of the Threat Hunter

Threat hunting now requires automation. The scope and velocity of contemporary dangers render manual analysis insufficient on its own. AI is essential because it manages the high-volume, high-speed tasks that humans are unable to complete. The modern threat hunting process is powered by AI agents. They automatically identify and indicate those that are genuinely catastrophic as they sort through a large number of possible risks. Crucially, people are still involved in the process. Rather, it keeps them informed. Human threat hunters can concentrate on higher-level thinking, such as comprehending systemic danger, developing long-term strategy, and determining how to respond, as AI takes care of the time-sensitive and routine tasks. To put it simply, AI locates the needle in the haystack and humans make decisions about the needle, the haystack and the farm as a whole. In the future, threat hunting will neither be entirely automated nor entirely manual. Each will have a specific and essential role in the collaboration.

Hunting for What Comes After the Attack

The emphasis on identifying past adversary presence is another crucial development in threat hunting. Attackers don't always stay. An adversary may frequently take advantage of a weakness, accomplish their goal (such deploying an infostealer) and then go. That does not imply that the threat has passed. The concept of Marathon CVEs - vulnerabilities like Log4Shell that are never completely fixed - is based on this reality. Attackers' artifacts and exploitation efforts persist even after patches are implemented. Because of this, assuming a breach is a fundamental component of contemporary threat hunting. Identification of post-exploitation behaviour, such as web shells, backdoors, credential modifications and other signs that continue long after the initial intrusion, must be the foundation of detection strategies. Finding these long-burn hazards requires ongoing cleanup efforts. It is an ongoing security feature that is integrated into regular business processes. Even when attackers come and go, organizations that handle it as such are better positioned to lower long-term risk. Also read: What is Threat Hunting?

Looking Ahead

The goal of threat hunting is becoming more apparent as 2026 approaches. Thinking more deeply is now more important than responding more quickly. Organizations can develop a more robust and practical defence posture by concentrating on attacker behaviour, embracing automation without sacrificing human judgment, and persistently searching for persistent threats. Proactive threat hunting is the cornerstone of this concept, not only an enhancement.

Also read: Beyond 24/7: How Smart CISOs are Rethinking Threat Hunting

Rizwan Patel, Global Head Cloud, InfoSec and Emerging Technologies, Altimetrik Global commerce no longer pauses between festivals; it moves continuously across markets, moments, and geographies. India's Diwali and Navratri have passed, yet the digital intensity they generated merely sets the stage for what comes next. Christmas shopping surges are building momentum across global markets, followed closely by fiscal closures and Lunar New Year preparations across Asia. What was once a sequence of seasonal events has become a single, continuous stress test of enterprise infrastructure and digital trust. Adversarial AI operates inside this same cycle, and it never takes holidays. While technology leaders finalize year-end campaigns, automated threat networks run relentless reconnaissance against digital platforms, learning transaction patterns, mapping authentication architectures, and calculating optimal breach windows. The asymmetry is significant: enterprises expand transaction capacity during high-volume periods but rarely scale detection capabilities at the same speed. Adversarial systems adapt instantly, while human teams operate on predictable shifts. Every vendor integration, partner API, or cross-border payment is now part of a shared attack surface. Reliability and trust are no longer defined by uptime alone but by resilience under pressure. The next breach may not strike when systems are weakest—it may strike when commerce is strongest. The real question for technology leaders is no longer when adversarial AI will test their systems, but whether their defenses can keep pace when it does.

The Global Commerce Vulnerability Window

High-volume shopping periods create a concentrated attack surface that threat actors exploit with precision. During the 2024 holiday season, December recorded 574 ransomware incidents, the highest monthly volume since monitoring began in 2021 according to NCC Group's Threat Pulse report. The trend overturns historical patterns where December once saw slower attack activity during year-end breaks. Cybersecurity experts increasingly refer to these periods as the Global Commerce Vulnerability Window, marked by intense transaction volumes and limited human oversight across regions that shift like moving targets. As one market reaches its festive peak, adversarial networks redirect focus to the next, maintaining continuous pressure on enterprise systems. The exposure extends deep into B2B ecosystems that enable these surges. Breaches on consumer-facing platforms can cascade through partner networks, exposing critical dependencies across cloud, financial, and logistics systems. A single incident during a client’s key revenue window can erode partner confidence, delay renewals, and weaken market standing while competitors seize the opportunity to advance.

The Strategic Leadership Playbook

Enterprise leaders navigating perpetual threat cycles must architect their security posture around three interdependent capabilities that operate as integrated systems rather than isolated functions. Intelligent Trust transforms security from an invisible assumption into a tangible asset. Explainable AI systems must demonstrate their decision-making logic to both technical teams and business stakeholders. Real-time consent management platforms show customers exactly how their data moves through your infrastructure. During high-volume integrations, visible trust indicators such as verified credentials, anomaly alerts, and transparent data workflows help sustain confidence across partners. Trust becomes an operational metric, tracked and improved with the same rigor as uptime or throughput. Dynamic Compliance treats regulatory adherence as a living system rather than a periodic audit exercise. Laws such as the EU’s GDPR, the U.S. CCPA, India’s DPDP Act, and the EU AI Act emphasize consent, accountability, and transparency across data and AI systems. Additionally, consent-first APIs, continuous monitoring, and automated audit trails ensure alignment across jurisdictions. Treating compliance as a living system builds trust and resilience in an environment where both regulations and risks advance continuously. Autonomous Resilience represents the frontier where agentic systems deliver measurable business value. Guardian Agents operate as intelligent, goal-oriented systems that function within defined governance boundaries. These agents continuously scan transaction patterns for data anomalies, detect adversarial behavior through behavioral analysis, and initiate mitigation protocols automatically. They coordinate with human oversight teams to escalate critical decisions or accept override commands. Most importantly, they evolve through machine learning as threat patterns shift, ensuring your defense posture adapts faster than manual processes allow. This shift from reactive monitoring to self-governed prevention reduces both detection time and response resource requirements, allowing security teams to focus on architecture and strategy rather than tactical firefighting.

The AI Paradox Driving Next-Generation Defense

AI now defines both sides of the cybersecurity equation. According to The IBM 2025 Cost of a Data Breach Report while AI-enabled defenses save organizations nearly $1.9 million per breach, 13% of enterprises faced breaches in AI models or applications often owing to weak access controls. This paradox defines today’s leadership challenge. Autonomous systems deliver measurable advantage, but must remain adaptive, governed, and accountable. Guardian Agents exemplify this evolution through continuous behavioural learning, establishing baselines for normal activity and detecting deviations before traditional defenses respond. Their orchestration model allows coordination across distributed endpoints, sharing intelligence while preserving local decision authority. Each automated response is mapped through audit trails to the specific anomaly that triggered it, enabling transparency and human validation. This alignment of machine precision and human oversight ensures accountability even as response speeds surpass human reaction times. As enterprises expand across jurisdictions and regulatory frameworks, this transition from autonomous to adaptive defense defines the next frontier. The real test of leadership now lies in redefining what resilience means in an era where intelligence itself is the battlefield. AI will not wait for regulation, nor will adversaries wait for readiness. The future belongs to enterprises that can operationalize foresight, building systems that anticipate change, adapt without instruction, and uphold trust even under attack. Those that succeed will not only secure their data but shape the digital order that follows. (This article reflects the author’s analysis and personal viewpoints and is intended for informational purposes only. It should not be construed as legal or regulatory advice.)

By Salleh Kodri, Sr Presales consultant, Cyble As 2025 comes to a close, one thing is clear to me: The most damaging cyber incidents across ASEAN this year did not start with malware, zero-days, or system breaches. They started with trust. Across my work in Malaysia, Singapore, Thailand, Indonesia, the Philippines, and Vietnam, I repeatedly saw organizations doing “everything right” from a technical security standpoint, yet still suffering real-world damage because their brand, identity, or executives were exploited. 2025 was the year many of us finally realized that brand is no longer a marketing concern. It is a cyber asset, and in ASEAN, it has become one of the most abused attack surfaces.

Malaysia: When Customers Were Hit Before Banks Even Knew

In Malaysia, I saw multiple cases where:

• Fake banking websites and phishing pages were already circulating
• Scam campaigns were active in Bahasa Malaysia
• Customers were already losing money

Before the institution itself had any alert. What struck me was this: There was no breach. No malware. No SOC alert. The damage happened entirely outside the bank’s environment, through brand impersonation, fake domains, and social media abuse. By the time complaints reached the organization, trust had already eroded. The lesson was painful but clear: If you only monitor what happens inside your network, you will always be late.

Singapore: Reputation Damage Moves Faster Than Regulation

In Singapore, the challenge was not capability, it was speed and exposure. I observed:

• Fake government-related services appearing online
• Impersonation attempts abusing official-looking communications
• Scam infrastructure spun up and taken down rapidly

Even in a highly regulated, mature environment, brand abuse moved faster than response processes. What concerned stakeholders most was not technical impact, but public confidence. Once trust is questioned, no amount of post-incident explanation can fully undo the damage. Singapore reinforced a critical truth for me in 2025: Cybersecurity maturity does not automatically protect digital reputation.

Thailand: Executive Impersonation Became the Weakest Link

In Thailand, the most alarming trend I encountered was executive identity abuse. We saw:

• Fake LINE and WhatsApp accounts impersonating senior leaders
• Social media profiles cloning executives from banks and enterprises
• Attempts to influence internal decisions using perceived authority

These were not sophisticated hacks. They were psychological attacks, exploiting hierarchy, respect, and urgency. What made this dangerous was that traditional security tools had no visibility into it. The risk sat squarely at the intersection of human trust and digital identity, a space most security programs were not designed to defend.

Indonesia: Scale Made Brand Abuse a Business Model

Indonesia showed me what happens when scale meets weak visibility. With its massive digital population, attackers exploited:

• Fake mobile apps using trusted brand names
• Clone domains targeting regional customers
• Long-running scam campaigns that reused infrastructure

In several cases, takedown efforts were slow, not because teams didn’t care, but because they discovered the abuse far too late. By the time action was taken, the attackers had already moved, rebranded, and relaunched elsewhere. Indonesia highlighted something important: Brand abuse in ASEAN is not opportunistic, it is industrialized.

Philippines: Trust Was Exploited Through Familiarity

In the Philippines, what stood out to me was how attackers weaponized familiar communication channels. We encountered:

• SMS and messaging-based impersonation
• Social engineering campaigns tailored to local behavior
• Brand abuse that felt “normal” to recipients

Victims didn’t think they were being attacked. They thought they were interacting with legitimate services. The danger here wasn’t technology, it was perception. And perception is exactly what brand abuse manipulates best.

Vietnam: Digital Growth Outpaced Brand Defense

Vietnam’s rapid digital growth in 2025 came with an unintended consequence: Brand exposure expanded faster than brand protection. I observed:

• New digital services being impersonated almost immediately
• Fake pages and domains launched within days of public announcements
• Limited monitoring beyond core infrastructure

Vietnam reminded me that digital transformation without intelligence-led visibility creates silent risk, especially when brand assets are treated as secondary concerns.

Why 2025 Changed My View on Cyber Risk in ASEAN

Across all these countries, one pattern kept repeating:

• No malware required
• No system compromise needed
• No technical alert triggered

Yet real harm occurred—financial, reputational, and regulatory. That was my biggest takeaway of 2025: Cyber risk in ASEAN is no longer defined by system compromise alone. It is defined by how easily trust can be abused.

Brand Is Now a Cyber Asset, Whether We Like It or Not

In 2025, I stopped asking: “Is this a cybersecurity issue?” And started asking: “Does this harm trust, safety, or public confidence?” Because once customers, citizens, or partners lose trust, recovery becomes exponentially harder than restoring a system from backup. Brands, executives, and digital identities now require the same discipline we apply to networks and endpoints:

• Continuous monitoring
• Early intelligence
• Rapid disruption
• Clear ownership

Looking Into 2026: Trust Will Be the New Perimeter

As ASEAN continues to digitize, attackers will not slow down. They will go where defense is weakest, and in many organizations, that is still outside the firewall. In 2026, the question will no longer be: “Are we secure?” It will be: “Do we know how our brand, identity, and trust are being abused—right now?” Those who answer that question honestly and act on it will be ahead. Those who don’t will keep defending systems while attackers exploit perception.

Personal Closing

2025 changed how I see cybersecurity in ASEAN. Not as a technology problem, but as a trust problem. And trust, once lost, is the hardest asset to recover. (This article reflects the author’s analysis and personal viewpoints and is intended for informational purposes only. It should not be construed as legal or regulatory advice.)

By Srinivas Shekar, CEO and Co-Founder, Pantherun Technologies Cyberattacks powered by artificial intelligence are moving faster, spreading wider, and targeting businesses with unprecedented precision. As we look toward Cybersecurity 2026, security teams must rethink how they protect what matters most: their data. Traditional defenses are struggling to keep pace with the speed, intelligence, and persistence of modern threats. Protecting sensitive information is no longer limited to a few industries, it has become a universal priority for organizations of all sizes. Cybersecurity in 2026 is no longer only about stopping intrusions. It is about ensuring that even if attackers gain access, they walk away with nothing of value. This calls for a shift from perimeter-focused security to continuous protection of the data itself. With businesses rapidly adopting cloud platforms and SaaS applications, the amount of sensitive information being shared and stored online continues to rise. Each new application, integration, or workflow expands the attack surface, giving threat actors more opportunities to exploit weaknesses.

Key Cybersecurity 2026 Trends to Watch Out For 

• Supply-chain and insider threats will grow, elevating device-level security: As reliance on vendors, partners, and automated systems increases, attackers will exploit trusted channels more frequently. Insider risks, both accidental and intentional, will also rise. In this landscape, network security alone will not be enough. Protection must move with the data, regardless of where it travels or who accesses it
• Real-time data protection will take center stage: Cyberattacks unfold in seconds. Traditional tools that rely on detection and response often move too slowly against AI-driven threats. SaaS environments, in particular, have become frequent targets due to misconfigurations, weak access controls, and third-party integrations. By 2026, organizations will focus less on stopping every attack and more on ensuring that data remains protected at all times. Real-time encryption will play a critical role, rendering stolen data unreadable and unusable even when systems are breached
• Ransomware will shift from disruption to pressure tactics: Ransomware attacks will evolve beyond simply locking systems. Attackers will study the data they steal and use it to apply pressure through reputational damage, operational disruption, or regulatory exposure. This form of targeted extortion will force organizations to strengthen data protection across endpoints and devices, ensuring sensitive information is never exposed in plain form at any point
• Identity-based security will give way to data-centric approaches: Stolen credentials, hijacked sessions, and impersonation attacks are becoming easier for adversaries to execute. When identities can no longer be fully trusted, securing the data itself becomes the most reliable defense. By 2026, organizations will place greater emphasis on protecting information even when user accounts are compromised
• Quantum computing will put existing encryption to the test: Advancements in quantum computing will eventually threaten many current encryption standards. Attackers may already be collecting encrypted data with the intention of decrypting it in the future. To stay ahead, enterprises will begin preparing for quantum-safe encryption, especially for long-term sensitive data. Real-time encryption and robust key management will become increasingly important

Cybersecurity in 2026 is entering a decisive phase. AI-powered attacks, expanding digital ecosystems, and growing internal and external risks are pushing traditional security models to their limits. The organizations that succeed will be those that protect what truly matters, the data itself. By embracing real-time encryption and continuous data protection, businesses can strengthen resilience and limit the damage from inevitable breaches. (This article reflects the author’s analysis and personal viewpoints and is intended for informational purposes only. It should not be construed as legal or regulatory advice.)

Mumbai, India – December 19, 2026 — ET Edge has recognized Beenu Arora, CEO & Co-Founder of Cyble, as one of India’s Impactful CEOs 2025, honoring visionary leaders who demonstrate exceptional leadership, innovation, and measurable impact in shaping the future of business and technology. The ET Edge Impactful CEO recognition honors leaders who drive transformation through strategic, purpose-driven leadership. Beenu Arora’s inclusion highlights his continued focus on advancing cybersecurity innovation and strengthening digital trust globally. 

Purpose-Driven Leadership Behind Cyble’s Global Growth

Under Beenu Arora’s leadership, Cyble has grown into a globally recognized cybersecurity intelligence provider, delivering AI-powered threat intelligence and digital risk protection to help enterprises and governments proactively combat threats across surface, serious, and dark web ecosystems. Beenu’s leadership philosophy centers on purposeful innovation, customer focus, and empowering teams to address real-world security challenges at scale. He has led Cyble through rapid global expansion while fostering a culture of integrity, collaboration, and continuous learning. His focus on AI-driven, actionable intelligence has positioned Cyble as a trusted partner in an increasingly complex cyber threat landscape.  “This recognition by ET Edge is deeply humbling and reinforces our belief that cybersecurity is no longer just a technology challenge; it is a business and societal imperative,” said Beenu Arora, CEO & Co-Founder of Cyble. This honor belongs to the entire Cyble team, whose passion, innovation, and commitment to protecting the digital ecosystem inspire everything we do.  He further added, “Our focus remains on building intelligence-led, AI-driven solutions that help organizations anticipate risks, make informed decisions, and enhance their long-term digital resilience. We are committed to creating a safer and more trusted digital future for businesses and governments around the world.” The ET Edge Impactful CEO 2025 recognition underscores Cyble’s growing global influence and highlights Beenu Arora’s role as a forward-thinking leader driving innovation and resilience in cybersecurity.

About Cyble 

Founded as an AI-first cybersecurity company, Cyble delivers real-time threat intelligence, digital risk protection, and predictive cyber defense solutions to enterprises and governments worldwide. Trusted by Fortune 500 organizations and public sector agencies, Cyble is committed to making the digital world safer through intelligent, autonomous cybersecurity.  For more information on Cyble’s Agentic AI-powered cybersecurity solutions, visit www.cyble.com.  Media Contact: 📧 enquiries@cyble.com 📞 +1 888 673 2067 

By Gauravdeep Singh, Head – State e-Mission Team (SeMT), Ministry of Electronics and Information Technology The Digital Personal Data Protection (DPDP) Act has fundamentally altered the risk landscape for Indian organisations. Data breaches now trigger mandatory compliance obligations regardless of their origin, transforming incidents that were once purely operational concerns into regulatory events with significant financial and legal implications.

Case Study 1: Cloud Misconfiguration in a Consumer Platform

A prominent consumer-facing platform experienced a data exposure incident when a misconfigured storage bucket on its public cloud infrastructure inadvertently made customer data publicly accessible. While no malicious actor was involved, the incident still constituted a reportable data breach under the DPDP Act framework. The organisation faced several immediate obligations:

• Notification to affected individuals within prescribed timelines
• Formal reporting to the Data Protection Board
• Comprehensive internal investigation and remediation measures
• Potential penalties for failure to implement reasonable security safeguards as mandated under the Act

Such incidents highlight a critical gap in traditional risk management approaches. The financial exposure—encompassing regulatory penalties, legal costs, remediation expenses, and reputational damage—frequently exceeds conventional cyber insurance coverage limits, particularly when compliance failures are implicated.

Case Study 2: Ransomware Attack on Healthcare and EdTech Infrastructure

A mid-sized healthcare and education technology provider fell victim to a ransomware attack that encrypted sensitive personal records. Despite successful restoration from backup systems, the organisation confronted extensive regulatory and operational obligations:

• Forensic assessment to determine whether data confidentiality was compromised
• Mandatory notification to regulatory authorities and affected data principals
• Ongoing legal and compliance proceedings

The total cost extended far beyond any ransom demand. Forensic investigations, legal advisory services, public communications, regulatory compliance activities, and operational disruption collectively created substantial financial strain, costs that would have been mitigated with appropriate insurance coverage.

Case Study 3: AI-Enabled Fraud and Social Engineering

The emergence of AI-driven attack vectors has introduced new dimensions of cyber risk. Deepfake technology and sophisticated phishing campaigns now enable threat actors to impersonate senior leadership with unprecedented authenticity, compelling finance teams to authorise fraudulent fund transfers or inappropriate data disclosures. These attacks often circumvent traditional technical security controls because they exploit human trust rather than system vulnerabilities. As a result, organisations are increasingly seeking insurance coverage for social engineering and cyber fraud events, particularly those involving personal data or financial information, that fall outside conventional cybersecurity threat models.

The Evolution of Cyber Insurance in India

The Indian cyber insurance market is undergoing significant transformation in response to the DPDP Act and evolving threat landscape. Modern policies now extend beyond traditional hacking incidents to address:

• Data breaches resulting from human error or operational failures
• Third-party vendor and SaaS provider security failures
• Cloud service disruptions and availability incidents
• Regulatory investigation costs and legal defense expenses
• Incident response, crisis management, and public relations support

Organisations are reassessing their coverage adequacy as they recognise that historical policy limits of Rs. 10–20 crore may prove insufficient when regulatory penalties, legal costs, business interruption losses, and remediation expenses are aggregated under the DPDP compliance framework.

The SME and MSME Vulnerability

Small and medium enterprises represent the most vulnerable segment of the market. While many SMEs and MSMEs regularly process personal data, they frequently lack:

• Mature information security controls and governance frameworks
• Dedicated compliance and data protection teams
• Financial reserves to absorb penalties, legal costs, or operational disruption

For organisations in this segment, even a relatively minor cyber incident can trigger prolonged operational shutdowns or, in severe cases, permanent closure. Despite this heightened vulnerability, cyber insurance adoption among SMEs remains disproportionately low, driven primarily by awareness gaps and perceived cost barriers.

Implications for the Cyber Insurance Ecosystem

The Indian cyber insurance market is entering a period of accelerated growth and structural evolution. Several key trends are emerging:

• Higher policy limits becoming standard practice across industries
• Enhanced underwriting processes emphasising compliance readiness and data governance maturity
• Comprehensive coverage integrating legal advisory, forensic investigation, and regulatory support
• Risk-based pricing models that reward robust data protection practices

Looking ahead, cyber insurance will increasingly be evaluated not merely as a risk-transfer mechanism, but as an indicator of an organisation's overall data protection posture and regulatory preparedness.

DPDP Act and the End of Optional Cyber Insurance

The DPDP Act has fundamentally redefined cyber risk in the Indian context. Data breaches are no longer isolated IT failures; they are regulatory events carrying substantial financial, legal, and reputational consequences. In this environment, cyber insurance is transitioning from a discretionary safeguard to a strategic imperative. Organisations that integrate cyber insurance into a comprehensive data governance and enterprise risk management strategy will be better positioned to navigate the evolving regulatory landscape. Conversely, those that remain uninsured or underinsured may discover that the cost of inadequate preparation far exceeds the investment required for robust protection. (This article reflects the author’s analysis and personal viewpoints and is intended for informational purposes only. It should not be construed as legal or regulatory advice.)

Nikhil Jhanji, Principal Product Manager, Privy by IDfy The DPDP rules have finally given enterprises a clear structure for how personal data enters and moves through their systems. What has not been discussed enough is that this same structure also reduces the space in which deepfakes and synthetic identities can slip through. For months the Act lived in broad conversation without detail. Now enterprises have to translate the rules into real action. As they do that work, a practical advantage becomes visible. The discipline required around consent, accuracy, and provenance creates an environment where false personas cannot blend in as easily. This was not the intention of the framework, but it is an important consequence.

DPDP Rules Bring Structure to Enterprise Data Intake

The first shift happens at data entry. The rules require clear consent, proof of lawful purpose, and timely correction of errors. This forces organisations to examine the origin of the data they collect and to maintain records that confirm why the data exists. Better visibility into the source and purpose of data makes it harder for synthetic identities to enter the system through weak or careless intake flows. This matters because the word synthetic now carries two very different meanings. One meaning refers to responsible synthetic data used in privacy enhancing technologies. This type is created intentionally, documented carefully, and used to train models or test systems without revealing personal information. It supports the goals of privacy regulation and does not imitate real individuals.

Synthetic Data vs Synthetic Identity: A Critical Difference

The other meaning refers to deceptive synthetic identities, false personas deliberately created to exploit weak verification processes. These may include deepfake facial images, manipulated voice samples, and fabricated documents or profiles that appear legitimate enough to pass routine checks.

This form of synthetic identity thrives in environments with poor data discipline and is designed specifically to mislead systems and people.

The DPDP rules help enterprises tell the difference with more clarity. Responsible synthetic data has provenance and purposeful creation. Deceptive synthetic identity has neither. Once intake and governance become more structured, the distinction becomes easier to detect through both human review and automated systems.

Cleaner Data Improves Fraud and Risk Detection

As organisations rewrite consent journeys and strengthen provenance under the DPDP rules, the second advantage becomes clear. Cleaner input improves downstream behaviour. Fraud engines perform better with consistent signals. Risk decisions become clearer. Customer support teams gain more dependable records. When data is scattered and unchecked, synthetic personas move more freely. When data is organised and verified, they become more visible. This is where the influence of DPDP rules becomes subtle. Deepfake content succeeds by matching familiar patterns. It blends into weak systems that cannot challenge continuity. Structured data environments limit these opportunities. They reduce ambiguity and shrink the number of places where a false identity can hide. This gives enterprises a stronger base for every detection capability they depend on. There is also a behavioural shift introduced by the DPDP rules. Once teams begin managing data with more discipline, their instinct around authenticity improves. Consent is checked properly. Accuracy is taken seriously. Records are maintained rather than ignored. This change in everyday behaviour strengthens identity awareness across the organisation. Deepfake risk is not only technical. It is also operational, and disciplined teams recognise anomalies faster.

DPDP Rules Do Not Stop Deepfakes—but They Shrink the Attack Surface

None of this means that DPDP rules stop deepfakes. They do not. Deepfake quality is rising and will continue to challenge even mature systems. What the rules offer is a necessary foundation. They push organisations to adopt habits of verification, documentation, and controlled intake. Those habits shrink the attack surface for synthetic identities and improve the effectiveness of whatever detection tools a company chooses to use. As enterprises interpret the rules, many will see the work as procedural. New notices. Updated consent. Retention plans. But the real strength will emerge in the functions that depend on reliable identity and reliable records. Credit decisions. Access management. Customer onboarding. Dispute resolution. Identity verification. These areas become more stable when the data that supports them is consistent and traceable. The rise of deepfakes makes this stability essential. False personas are cheap to create and increasingly convincing. They will exploit gaps wherever they exist. Strong tools matter, but so does the quality of the data that flows into those tools. Without clean and verified data, even advanced detection systems struggle. The DPDP rules arrive at a moment when enterprises need stronger foundations. By demanding better intake discipline and clearer data pathways, they reduce the natural openings that deceptive synthetic content relies on. In a world where authentic and synthetic individuals now compete for space inside enterprise systems, this shift may become one of the most practical outcomes of the entire compliance effort. (This article reflects the author’s analysis and personal viewpoints and is intended for informational purposes only. It should not be construed as legal or regulatory advice.)

Shashank Bajpai, CISO & CTSO at Yotta 2026 is the execution year for India’s Digital Personal Data Protection (DPDP) regime , the Rules were notified in November 2025 and the government has signalled a phased enforcement timeline. The law is consent-centric, imposes heavy penalties (up to ₹250 crore for the most serious security failures), creates a new institutional stack (Data Protection Board, Consent Managers), and elevates privacy to boardroom priority. Organizations that treat compliance as a strategic investment, not a cost centre, will gain trust, operational resilience, and competitive advantage. Key themes for 2026: consent at scale, data minimization, hardened security, vendor accountability, and new dependency risks arising from Consent Manager infrastructure.

Why 2026 Matters

The DPDP Act (2023) becomes operational through Rules notified in November 2025; the result is a staggered compliance timetable that places 2026 squarely in the execution phase. That makes 2026 the inflection year when planning becomes measurable operational work and when regulators will expect visible progress. The practical effect is immediate: companies must move from policy documents to implemented consent systems, security controls, breach workflows, and vendor governance.

The High-Impact Obligations

• Explicit consent architecture: Consent must be free, specific, informed and obtained by clear affirmative action. Systems must record, revoke and propagate consent signals reliably.
• Data minimization & purpose limitation: Collect only what’s necessary and purge data when the purpose is fulfilled.
• Reasonable security safeguards: Highest penalty bracket (up to ₹250 crore) for failures to implement required security measures. Encryption, tokenization, RBAC, monitoring and secure third-party contracts are expected.
• Breach notification: Obligatory notification to the Data Protection Board and affected principals, with tight timelines (public guidance references 72-hour reporting windows for board notification).
• Data subject rights: Access, correction, erasure, withdrawal of consent and grievance mechanisms must be operational and auditable.
• Children’s data: Verifiable parental consent and prohibitions on behavioural profiling/targeted advertising toward minors; failures risk very high penalties.
• Consent Managers: New regulated intermediaries where individuals may centrally manage consent; only India-incorporated entities meeting financial/operational thresholds (minimum net worth indicated in Rules) can register. This constructs a new privacy infrastructure and a new dependency vector for data fiduciaries.

Implementation Challenges & Strategic Opportunities

1. Key Implementation Challenges

Challenge Area	What Will Break / Strain in 2026	Why It Matters to Leadership	Strategic Imperative
Regulatory Ambiguity & Evolving Interpretation	Unclear operational expectations around “informed consent,” Significant Data Fiduciary designation, and cross-border data transfers	Risk of over-engineering or non-compliance as regulatory guidance evolves	Build modular, configurable privacy architectures that can adapt without re-platforming
Legacy Systems & Distributed Data	Difficulty retrofitting consent enforcement, encryption, audit trails, and real-time controls into legacy and batch-oriented systems	High cost, operational disruption, and extended timelines for compliance	Prioritize modernization of high-risk systems and align vendor roadmaps with DPDP requirements
Organizational Governance & Talent Gaps	Privacy cuts across legal, product, engineering, HR, procurement—often without clear ownership; shortage of experienced DPOs	Fragmented accountability increases regulatory and breach risk	Establish cross-functional privacy governance; leverage fractional DPOs and external advisors while building internal capability
Children’s Data & Onboarding Friction	Age verification and parental consent slow user onboarding and impact conversion metrics	Direct revenue and growth impact if UX is not carefully redesigned	Re-engineer onboarding flows to balance compliance with user experience, especially in consumer platforms
Consent Manager Dependency & Systemic Risk	Outages or breaches at registered Consent Managers can affect multiple data fiduciaries simultaneously	Creates concentration and third-party systemic risk	Design fallback mechanisms, redundancy plans, and enforce strong SLAs and audit rights

 2. Strategic Opportunities: Turning Compliance into Advantage

Opportunity Area	Business Value	Strategic Outcome
Trust as a Market Differentiator	Privacy becomes a competitive trust signal, particularly in fintech, healthtech, and BFSI ecosystems.	Strong DPDP compliance enhances brand equity, customer loyalty, partner confidence, and investor perception.
Operational Efficiency & Risk Reduction	Data minimization, encryption, and segmentation reduce storage costs and limit breach blast radius.	Privacy investments double as technical debt reduction with measurable ROI and lower incident recovery costs.
Global Market Access	Alignment with global privacy principles simplifies cross-border expansion and compliance-sensitive partnerships.	Faster deal closures, reduced due diligence friction, and improved access to regulated international markets.
Domestic Privacy & RegTech Ecosystem Growth	Demand for Consent Managers, RegTech, and privacy engineering solutions creates a new domestic market.	Strategic opportunity for Indian vendors to lead in privacy infrastructure and export DPDP-aligned solutions globally.

DPDP Readiness Roadmap for 2026

Time Horizon	Key Actions	Primary Owners	Strategic Outcome
Immediate (0–3 Months)	• Establish Board-level Privacy Steering Committee •Appoint or contract a Data Protection Officer (DPO) • Conduct rapid enterprise data mapping (repositories, processors, high-risk data flows) • Triage high-risk systems for encryption, access controls, and logging • Update breach response runbooks to meet Board and individual notification timelines	Board, CEO, CISO, Legal, Compliance	Executive accountability for privacy; clear visibility of data risk exposure; regulatory-ready breach response posture
Short Term (3–9 Months)	• Deploy consent management platform interoperable with upcoming Consent Managers • Standardize DPDP-compliant vendor contracts and initiate bulk vendor renegotiation/audits • Automate data principal request handling (identity verification, APIs, evidence trails)	CISO, CTO, Legal, Procurement, Product	Operational DPDP compliance at scale; reduced manual handling risk; strengthened third-party governance
Medium Term (9–18 Months)	• Implement data minimization and archival policies focused on high-sensitivity datasets • Embed Privacy Impact Assessments (PIAs) into product development (“privacy by design”) • Stress-test reliance on Consent Managers and negotiate resilience SLAs and contingency plans	Product, Engineering, CISO, Risk, Procurement	Sustainable compliance architecture; reduced long-term data liability; privacy-integrated product innovation
Ongoing (Board Dashboard Metrics)	• Consent fulfillment latency & revocation success rate • Mean time to detect and notify data breaches (aligned to regulatory windows) • % of sensitive data encrypted at rest and in transit • Vendor compliance score and DPA coverage	Board, CISO, Risk & Compliance	Continuous assurance, measurable compliance maturity, and defensible regulatory posture

Board-Level Takeaway

DPDP compliance in 2026 is not a one-time legal exercise, it is an operating model change. Organizations that treat privacy as a board-governed, product-integrated, and metrics-driven discipline will outperform peers on regulatory trust, customer confidence, and incident resilience.

The Macro View: Data Sovereignty & Trust Infrastructure

The Rules reinforce India’s intention to control flows of citizen data while creating domestic privacy infrastructure (DPB + Consent Managers + data auditors). This is not just regulation; it is an economic strategy to build domestic capability in cloud, identity, security and RegTech, and to position India as a credible participant in global data governance conversations.

Act Strategically, Not Reactively

DPDP is a structural shift: it will change products, engineering practices, contracts, and customer expectations. 2026 will reveal winners and laggards. Those that embrace privacy as a governance discipline and a product differentiator will realize measurable advantages in trust, operational resilience, and market value. The alternative, waiting until enforcement escalates, risks fines, reputational harm and erosion of customer trust. (This article reflects the author’s analysis and personal viewpoints and is intended for informational purposes only. It should not be construed as legal or regulatory advice.)

By Kannan Srinivasan, Business Head – Cybersecurity, Happiest Minds Technologies Cyber resilience means being prepared for anything that might disrupt your systems. It’s about knowing how to get ready, prevent problems, recover quickly, and adapt when a cyber incident occurs. Generative AI, or GenAI, has become a big part of how many organizations work today. About 70% of industries are already using it, and over 95% of US companies have adopted it in some form. GenAI is now supporting nearly every area, including IT, finance, legal, and marketing. It even helps doctors make faster decisions, students learn more effectively, and shoppers find better deals. But what happens if GenAI breaks, gets messed up, or stops working? Once AI is part of your business, you need a stronger plan to stay safe and steady. Here are some simple ways organizations can build their cyber resilience in this AI-driven world.

A Practical Guide to Cyber Resilience in the GenAI Era

1. Get Leadership and the Board on Board

Leading the way in cyber resilience starts with your leaders. Keep your board and senior managers in the loop about the risks that come with GenAI. Get their support, make sure it lines up with your business goals, and secure enough budget for safety measures and training. Make talking about cyber safety a regular part of your meetings.

2. Know Where GenAI Is Being Used

Make a list of all departments and processes using GenAI. Note which models you're using, who manages them, and what they’re used for. Then, do a quick risk check—what could happen if a system goes down? This helps you understand the risks and prepare better backup plans.

3. Check for Weak Spots Regularly

Follow trusted guidelines like OWASP for testing your GenAI systems. Regular checks can spot issues like data leaks or misuse early. Fix problems quickly to stay ahead of potential risks.

4. Improve Threat Detection and Response

Use security tools that keep an eye on your GenAI systems all the time. These tools should spot unusual activity, prevent data loss, and help investigate when something goes wrong. Make sure your cybersecurity team is trained and ready to act fast.

5. Use More Than One AI Model

Don’t rely on just one AI tool. Having multiple models from different providers helps keep things running smoothly if one faces problems. For example, if you’re using OpenAI, consider adding options like Anthropic Claude or Google Gemini as backups. Decide which one is your main and which ones are backups.

6. Update Your Incident Plans

Review and update your plans for dealing with incidents to include GenAI, making sure they meet new rules like the EU AI Act. Once done, test them with drills so everyone knows what to do in a real emergency.

Conclusion

Cyber resilience in the GenAI era is a continuous process. As AI grows, the need for stronger governance, smarter controls, and proactive planning grows with it. Organizations that stay aware, adaptable, and consistent in their approach will continue to build trust and reliability. GenAI opens doors to efficiency and creativity, and resilience ensures that progress stays uninterrupted. The future belongs to those who stay ready, informed, and confident in how they manage technology.