As AI accelerates the pace and scale of cyber threats, organisations must strengthen identity controls, rethink security talent models and make cyber resilience a shared responsibility across the business.
The rapid adoption of artificial intelligence is reshaping enterprise cybersecurity, creating new opportunities for productivity while expanding the potential attack surface. As organisations deploy AI tools and autonomous agents across business operations, security teams must address risks that traditional controls may not be designed to manage.
Cybersecurity Awareness Month offers an opportunity to look beyond awareness campaigns and examine how organisations can build lasting resilience through secure technology design, stronger governance and a more informed workforce.
For Vaibhav Tare, CISO at Fulcrum Digital, the growing use of AI agents introduces a new layer of identity and access management challenges. These agents can interact with enterprise systems, access sensitive information and execute tasks with varying levels of autonomy. Without appropriate safeguards, they may become attractive targets for attackers or create vulnerabilities through excessive permissions and inadequate monitoring.
“Resilience is practiced every day and not achieved in one month.”
— Dr. Sanjay Kukreja, CTO, eClerx
Tare emphasises that AI systems must be governed with the same discipline applied to human users. Organisations need clear identities for agents, tightly controlled permissions and continuous oversight of their activities. Reused credentials, unmonitored access and poorly defined privileges can create openings that attackers may exploit.
Security must therefore be integrated into AI deployment from the beginning rather than added after systems are operational. Establishing controls early can help organisations reduce exposure and avoid the higher costs associated with incident response, remediation and recovery.
Cybersecurity becomes a business-wide priority
India’s accelerating digital transformation has made cybersecurity central to business continuity, customer confidence and regulatory compliance. Organisations increasingly depend on interconnected platforms, cloud services and digital ecosystems, making the protection of data and systems a leadership responsibility rather than an issue confined to technology teams.
“Hybrid security teams offer a practical answer. Strategic leadership stays in-house, where context and accountability sit, while specialized external pods handle complex, tactical execution.”
— Milind Shah, Managing Director, Randstad Digital – India
Sunil Sharma, Managing Director and Vice President – Sales for India and SAARC at Sophos, points to the importance of data stewardship and accountability as organisations respond to evolving requirements, including India’s Digital Personal Data Protection (DPDP) Act.
Compliance is an important consideration, but effective security requires more than meeting regulatory obligations. Organisations must establish clear responsibilities for protecting information, prepare employees to recognise potential threats and ensure that security practices are embedded into everyday business operations.
The human element remains particularly important. Employees who understand how to identify suspicious messages, handle sensitive information and report unusual activity can help reduce the likelihood of incidents escalating into major breaches. Awareness must be supported by practical guidance, leadership commitment and a culture in which reporting concerns is encouraged.
This approach recognises that security is a shared responsibility. Technology teams can deploy controls and monitor systems, but their effectiveness depends on informed decisions across the organisation.
AI creates a new challenge for security leaders
The impact of AI on cybersecurity extends beyond the deployment of AI agents. It is also changing how quickly vulnerabilities can be discovered, how much software is produced and how security teams must allocate their resources.
Ross McKerchar, CISO at Sophos, describes a growing pressure on security leaders as AI expands both the opportunities for defence and the scale of the challenge. AI can help accelerate vulnerability discovery, but it can also make it easier for attackers to identify weaknesses. Meanwhile, the growing use of AI agents creates additional systems and identities that must be secured.
“The organisations that will be most resilient are those that treat cybersecurity as a shared business responsibility.”
— Ross McKerchar, CISO, Sophos
Another challenge is the volume of code being generated. As development accelerates, security teams may struggle to review and validate every change at the same pace. This creates a potential gap between the speed of software production and the ability to assess its security.
These pressures compound an existing shortage of experienced cybersecurity professionals, particularly at senior levels. Security leaders must manage growing technical complexity while ensuring that people, processes and governance keep pace.
McKerchar’s emphasis on shared responsibility highlights the need for closer cooperation between security, development, operations and business leadership. Cybersecurity cannot remain an isolated function expected to absorb every new risk. It must be built into decisions about technology adoption, software development and business transformation.
“Cybersecurity is no longer just an IT consideration. It has become a critical business priority that underpins trust, resilience, and long-term success.”
— Sunil Sharma, Managing Director & VP – Sales (India & SAARC), Sophos
Rethinking the cybersecurity workforce
As threats become more sophisticated and the demand for specialist skills increases, organisations are reconsidering how cybersecurity capabilities should be structured.
Milind Shah, Managing Director at Randstad Digital – India, sees hybrid security teams as a practical way to address these pressures. Under this model, internal teams retain strategic direction, institutional knowledge and accountability, while external specialists support complex technical work that requires expertise or capacity not readily available in-house.
The model can help organisations respond to changing requirements without attempting to recruit every specialist skill permanently. It also allows internal security leaders to focus on risk priorities, business alignment and governance while external teams contribute targeted expertise.
However, the effectiveness of this approach depends on choosing partners who understand business outcomes rather than simply supplying tools or resources. Adding more products without a clear security strategy can create complexity, fragment visibility and increase the operational burden on already stretched teams.
A sustainable approach combines the right technology with clear ownership, measurable objectives and coordinated execution. Organisations must also continue investing in their internal talent pipelines through training, skills development and opportunities for professionals to build experience in emerging areas.
The objective is not simply to fill vacancies. It is to create a workforce model capable of adapting as technologies, attack methods and business requirements evolve.
“Every one of those agents needs the same basic hygiene we ask of employees: strong identity controls, least-privilege access and continuous monitoring.”
— Vaibhav Tare, CISO, Fulcrum Digital
Resilience starts with everyday behaviour
While AI, governance and talent remain central to cybersecurity strategy, everyday employee behaviour continues to influence how effectively organisations defend themselves.
Dr. Sanjay Kukreja, CTO at eClerx, emphasises that resilience is built through consistent habits rather than occasional awareness initiatives. Reporting suspicious emails, reviewing access rights, following secure processes and considering security during system design are practical actions that can strengthen an organisation’s overall posture.
These practices are particularly important in businesses where trust, sensitive information and client relationships are fundamental to operations. A single overlooked warning or inappropriate access decision can have consequences that extend beyond the immediate technology environment.
Embedding security into routine work helps employees recognise their role in protecting the organisation. It also encourages teams to raise concerns early, follow established procedures and treat security as part of delivering reliable services.
The principle of security by design reinforces this approach. Instead of relying exclusively on controls added after deployment, organisations should consider security requirements when designing applications, processes and workflows. This can help identify weaknesses earlier and reduce the effort required to address them later.
Moving from awareness to sustained resilience
The perspectives of these industry leaders point to a common conclusion: cybersecurity resilience cannot be delivered by a single technology, team or annual campaign.
AI adoption requires stronger identity management and continuous monitoring. Regulatory expectations make data governance and accountability increasingly important. The pace of software development and evolving threats are stretching security teams, while skills shortages are pushing organisations to reconsider how they source expertise. At the same time, employee awareness and everyday discipline remain essential.
For enterprises, the challenge is to connect these priorities into a coherent strategy. That means building security into AI and software development, establishing clear governance, combining internal leadership with specialist support where needed, and ensuring that employees understand their responsibilities.
Cybersecurity Awareness Month can serve as a reminder to assess these areas, but meaningful progress depends on what organisations do throughout the year. The most resilient businesses will be those that treat security not as a compliance exercise or an isolated technical function, but as a continuing commitment shared across the enterprise.