Indian enterprises are recalibrating cybersecurity spend around identity. AI-powered phishing, deepfake impersonation and automated credential theft are outpacing defences built for a network-centric era. A stolen password no longer marks the end of an attack. It is where the attack begins. Attackers who gain a single credential can now move across cloud systems, business applications and machine accounts before detection, often while appearing as a legitimate, trusted user.
This shift in how breaches actually unfold is modifying enterprise security budgets across India. Gartner projects India's end-user spending on information security will total USD 3.4 billion in 2026, up 11.7 per cent from 2025, with security software remaining the largest and fastest-growing segment."Identity-based attacks, such as credential compromise and deepfake-enabled fraud, are rapidly expanding the attack surface, making identity threat detection and response (ITDR) a core priority," said Shailendra Upadhyay, senior principal analyst, Gartner.
The research firm has identified identity-first security as a key priority for Indian enterprises as AI-driven threats and regulatory changes reshape the security landscape. The rollout of the DPDP Act and growing adoption of agentic AI are adding new layers of complexity to how organisations manage identity risk.
Rewriting The Attack Playbook
Enterprises are rethinking where identity fits within their cybersecurity architecture. "Organisations are increasingly shifting from treating identity as an access management problem to recognising it as a continuous security challenge," said Diwakar Dayal, Managing Director & Area Vice President, SentinelOne India & SAARC.
The shift reflects a broader move away from perimeter-based security, where users and devices were implicitly trusted once inside the corporate network. As workloads, applications and users become more distributed across cloud environments, organisations are moving towards contextual risk assessment and real-time monitoring throughout a session rather than relying solely on authentication at login.
Enterprises are making greater use of integrated security platforms that correlate identity, endpoint, cloud and behavioural telemetry to identify suspicious activity earlier and accelerate incident response. Many organisations, however, continue to operate with fragmented visibility, limiting their ability to detect sophisticated attacks early.
Sectors Driving Demand
Demand for identity-first tools, including IAM, ITDR, Privileged Access Management (PAM) and Zero Trust, is rising across India. Government departments, public sector undertakings, critical infrastructure operators, IT services firms and digital-native businesses lead the adoption curve as they expand across cloud, SaaS platforms, contractor access and machine identities.
IAM remains core to access and lifecycle management. PAM secures privileged accounts. ITDR detects identity-based attacks. Zero Trust provides the underlying policy framework. None of these controls alone, however, show where identity risk is accumulating across an environment, a gap that is pushing identity security posture management into its own category.
Adoption is no longer driven by compliance alone. Organisations are also acting in response to account takeovers, ransomware incidents, cloud migrations and the rapid rollout of AI agents with access to sensitive systems. According to Deloitte's 2026 State of AI in the Enterprise report, 40 per cent of Indian organisations now report significant or full AI usage, against a global average of approximately 28 per cent. That pace of adoption is widening the identity attack surface faster than most enterprise defences can keep up.
The Machine Identity Problem
As enterprises move AI from experimentation to production, identity governance is extending beyond employees. Service accounts, workloads, API credentials and AI agents require privileged access to enterprise systems, creating a rapidly growing population of non-human identities that traditional identity programmes were not designed to govern.
Organisations are responding by tightening least-privilege access, adopting short-lived credentials and just-in-time provisioning to limit unnecessary permissions. They are also strengthening governance over AI agents through clearly defined identities, tightly scoped access and auditable activity. "As AI becomes more autonomous, controlling what machines can do will be as important as controlling what people can do," said Debashish Jyotiprakash, Regional Vice-President, APAC, Qualys.
Gartner estimates that by 2028, 70 per cent of CISOs globally will deploy identity verification and identity proofing (IVIP) solutions to reduce identity-related risk. The timeline suggests identity-first security in India remains in an early build-out phase rather than at its peak. Regulators, vendors, and enterprises converge on the same conclusion. The next major security investment cycle will be built around who is accessing systems, not just what network they are on. |
