Why organisations now see cybersecurity as a business enabler

Shifts in cloud, identity, and AI are moving risk out of the server room and into the boardroom

Bengaluru: Customers today don’t just buy products — they buy confidence. Whether it’s a B2B enterprise deal or a consumer subscription, trust in an organisation’s ability to safeguard data and ensure uptime is increasingly tied to conversion, retention, and recurring revenue. Sales teams are finding that proof of robust security posture — including certifications, breach transparency, and zero-trust frameworks — can directly influence deal velocity and customer stickiness. In regulated sectors, it’s often the deciding factor. In this environment, cybersecurity doesn’t just protect value. It helps create it.

For decades, cybersecurity was treated as a cost — a backend safeguard handled quietly by IT teams, aimed at keeping threats out and operations running. But that mindset is rapidly shifting. As organisations embrace AI, scale through cloud, and navigate increasingly complex digital ecosystems, cybersecurity is moving out of the technical basement and into the strategic core. The role of the CISO is evolving, and the boardroom is paying attention.

Organisations are still struggling with a fragmented approach. “It’s not just about how much you invest; it’s about where and how you invest,” says Venkat Thoutam, Business Unit Security Officer – Dell IT and a Regional Security Lead -APJC . 

He says that while many organisations are adding more tools, they are not necessarily building a cohesive, risk-based cybersecurity framework. Security cannot operate in silos; it must be aligned with business priorities and integrated across IT, legal, and compliance functions.

“Human awareness continues to be the missing piece. Technology can mitigate risk, but without a culture of shared vigilance, extending to team members and partners, even the best tools fall short,” he says.

This cultural element — the shift from siloed controls to enterprise-wide awareness — is what separates tactical defences from strategic ones.

Human layer

Vinod V Jayaprakash, Consulting Cybersecurity Leader, EY GDS, agrees that the human layer is still underappreciated in most enterprises. “As a cyber leader, I recognise that ransomware attacks, AI-driven sophisticated social engineering, supply chain vulnerabilities, and executive-targeted phishing are among the most pressing threats we face today,” he says. 

He sees a meaningful shift underway. “The move toward true cyber resilience, integrating recovery and business continuity alongside the rise of AI-enhanced threat detection, quantum-resistant cryptography, and zero-trust security architectures promise stronger, more adaptive defences against the evolving cyber risks. These innovations maximise automation without sacrificing strategic human oversight.” Yet, he cautions: “Many enterprises overinvest in technology while underestimating the importance of human factors like security awareness, training, and governance. Lack of holistic risk management and vendor security oversight also leaves gaps that attackers are able to exploit.”

Sharda Tickoo, Country Manager for India & SAARC, Trend Micro, believes that cybersecurity today has a direct impact on an organisation’s commercial outcomes. “The biggest concerns aren't traditional threats in the conventional sense but major technological shifts that have emerged as critical risk vectors,” she says, pointing to AI, quantum computing, IoT, and deepfakes as compounding pressures on business continuity.

As AI becomes more agentic and capable of autonomous, cooperative problem-solving, the question of "excessive agency" becomes critical. (Sharda Tickoo, Country Manager-India & SAARC, Trend Micro)

“We're seeing adversaries weaponise AI faster than many organisations can secure it,” she adds. “The need of the hour is about protecting the data, models, and infrastructure that power it.”

She warns that rising budgets alone won’t protect revenue pipelines. “We have observed organisations are spending more, but they're still playing defence.” Many suffer from “tool sprawl,” yet still miss basics like unpatched vulnerabilities and cloud misconfigurations.

“The organisations that thrive will be those that embed security as a business enabler,” she says — turning abstract IT threats into measurable operational and financial risks. “Rising budgets without strategic evolution simply mean expensive losses instead of cheap ones.” For revenue-focused leaders, that shift — from defence to exposure management — may determine who gains customer trust and who loses it.

Kartik Shahani, Vice President of India and SAARC, CrowdStrike, sees AI-powered attacks, identity misuse, and cloud vulnerabilities as the biggest threats facing organisations today. “Adversaries are weaponising AI to accelerate, automate, and scale their attacks,” he says, noting how even lower-tier actors now use AI to write code and bypass security measures.

Autonomous agents that can reason, prioritise, and act across identity, endpoint, and cloud data in real-time – controlled by human analysts – are the future of security operations. (Kartik Shahani, Vice President-India and SAARC, CrowdStrike)

Identity has become the new frontline. “Attackers no longer break in, they log in,” Shahani warns, highlighting how credential abuse allows them to move laterally across systems unnoticed. Meanwhile, cloud adoption has intensified exposure. “Cloud intrusions surged 136% in the first half of 2025,” he notes, with misconfigurations and fragmented tools proving especially risky.

For defenders to stay ahead, AI must become their ally too — but not as just another tool. “Unlike copilots that follow ‘ask and respond’ models, AI agents can reason, make decisions, and act.” These systems, Shahani says, allow analysts to focus on strategy, while intelligent agents handle the grunt work.

His advice for the future? A single, unified architecture that shares intelligence across identity, endpoint, and cloud. That, he believes, is what will distinguish resilient businesses from vulnerable ones — especially when attackers are compressing the breach timeline from months to seconds.

Gautam Kapoor, Managing Director and Lead – Cybersecurity, Accenture India, believes the top threats haunting enterprise leaders today aren’t just technical—they’re operational and reputational. Insider risks, often underestimated, continue to be a major concern. “Negligence or malicious intent from within, especially in hybrid work environments, makes it difficult to contain exposure,” he notes.

There has been a significant increase in supply chain attacks over the last few years. The strategy has now changed from ‘going after the weakest link’ to going after the link, where with one hack you can get access to multiple organisations. (Gautam Kapoor, MD & Lead – Cybersecurity, Accenture-India)

AI has emerged as both a tool and a threat. Cybercriminals are now using generative AI to craft targeted phishing campaigns and impersonate executives through deepfakes—raising the stakes for fraud and data loss. At the same time, enterprises adopting AI without secured environments are inadvertently widening their attack surface.

Kapoor also flags the growing complexity of supply chain threats. “One breach in a third-party system can compromise multiple organisations,” he warns. 

What sets resilient firms apart, he argues, is foresight. “Designing secure systems from the start, embedding AI defensively, and automating response workflows are now strategic imperatives,” he says. As cyber risks evolve, Kapoor sees security not as overhead, but as the infrastructure of trust—baked into innovation cycles, customer relationships, and revenue protection. 

What’s also evolving is the public’s understanding of security. For Sudhakar Singh, Head of Responsible AI, SAP, the conversation is no longer limited to compliance — it’s about visibility and trust. “Security has moved from a supporting element or non-functional requirement to a primary buying criterion. Today, before checking the feature list, people ask, ‘Is it safe?’”

Security has moved from a supporting element or non-functional requirement to a primary buying criterion. Today, before checking the feature list, people ask, 'Is it safe?' (Sudhakar Singh, Head of Responsible AI, SAP)

He adds, “People increasingly recognise that security isn’t the responsibility of a few—it’s a collective task. Every person and every link in the chain matters to keep people, systems and the nation safe.”

This growing awareness is pushing security teams closer to the heart of business decision-making. Tickoo reinforces this shift: “The shift from reactive to truly proactive protection needs to be accompanied by visionary leadership, disciplined commitment to staying ahead of the curve, and the courage to invest in security as a business enabler.”

Many organizations still see cybersecurity as just a regulatory requirement, not as a way to support the business. (Amrish Kumar Jain- CIO, Tally Solutions)

Organisations that view cybersecurity as a strategic function — not just a risk-control measure — are better positioned to earn trust, close sales, and grow sustainably.