Rising cyberattacks push Indian SMEs to boost security spending: Report

Indian SMEs plan to increase cybersecurity spending as cyber incidents rise, but limited monitoring, in-house expertise and employee awareness continue to leave gaps in their security preparedness

Indian small and medium-sized businesses are putting more money into cybersecurity as attacks become harder to ignore. The Tata Tele Business Services-CyberMedia Research  found that 84 per cent of SMEs plan to increase cybersecurity spending over the next 12–24 months. For many SMEs, the planned increase in spending follows direct experience with cyberattacks, with 40 per cent reporting an incident in the past two years.

 

Another report from Kaspersky points to the wider threat, with 87 per cent of Indian SMBs surveyed reporting a cyber incident in the past year. Across APAC, phishing, software vulnerability exploitation and mass malware were among the most common threats, while a lack of employee awareness and security expertise remained key risks.

 

The Tata Tele Business Services-CMR research also reported that only 28 per cent of SMEs that experienced an incident made structural changes to their security, while just 12 per cent continuously monitor their cybersecurity environment. 

 

Cyber incidents are no longer limited to large companies

 

Kaspersky’s findings indicate that smaller businesses are increasingly facing the same broad range of cyber threats as larger enterprises. The company says that the idea that smaller organisations can stay below the radar of cybercriminals is becoming less relevant as businesses digitise and the cost of launching attacks falls.

 

The Kaspersky survey covered IT security specialists across SMBs and enterprises in 18 countries. On average, organisations in the APAC region experienced three different types of security incidents over the past year.

 

For SMBs, the most frequently encountered incidents were software vulnerability exploitation, phishing and mass malware attacks. Software vulnerability exploitation accounted for 20 per cent, followed by phishing at 19 per cent and mass malware attacks at 18 per cent. Even zero-day exploits, which ranked lowest among the listed incident types, were encountered by 6 per cent of organisations.

 

India recorded an incident rate of 87 per cent among SMBs surveyed by Kaspersky. Vietnam reported the highest rate in the region at 97 per cent, followed by Malaysia at 95 per cent and Indonesia at 92 per cent. Thailand and China reported lower rates of 82 per cent and 67 per cent, respectively.

 

For Indian SMEs, the TTBS-CMR findings show that these incidents are already influencing spending decisions. However, the report indicates that responding to an incident does not always lead to a broader change in security practices. 

 

More money is going into cybersecurity

 

The TTBS-CMR study shows that 84 per cent of Indian SMEs intend to increase cybersecurity investments over the next 12–24 months. This comes as businesses deal with a growing number of digital systems, employees working across different environments and increasing exposure to online threats. But investment does not necessarily mean that companies have established a continuous security operation. The study found that only 12 per cent of SMEs continuously monitor their cybersecurity environments. 

 

While cybersecurity budgets are set to rise, the current allocation remains relatively limited for many SMEs. The study found that 46 per cent of SMEs allocate less than 5 per cent of their IT budget to cybersecurity. 

 

The study also found that nearly 35 per cent of SMEs use multiple cybersecurity tools but have limited visibility into their risks. This points to another challenge for smaller businesses: having several security products does not automatically provide a complete view of what is happening across their systems.

 

The Kaspersky study shows a similar increase in security spending among SMBs across APAC. 78 per cent of SMBs in the region increased their cybersecurity budgets this year. Nearly half, or 48 per cent, allocated additional funds to expand their IT and IT security teams, while 32 per cent put additional money towards advanced security solutions such as extended detection and response (XDR), network detection and response (NDR) and security information and event management (SIEM).

 

This is significant for smaller businesses because cybersecurity spending is being increased and directed not just towards software but also towards people and security capabilities.

 

However, the TTBS-CMR findings suggest that SMEs still have difficulty converting these investments into a more mature security setup. Among those that experienced a cyber incident in the past two years, only 28 per cent made structural security changes afterwards. 

 

Skills and employees remain a weak link

 

One of the clearest areas of overlap between the two studies is the shortage of cybersecurity expertise.

 

According to TTBS-CMR, 45 per cent of Indian SMEs identify lack of in-house cybersecurity expertise as their biggest challenge. This becomes more important as businesses adopt multiple security products that require people to configure, monitor and respond to alerts.

 

Kaspersky’s findings show that the problem is not restricted to specialist security teams. Among SMBs surveyed across APAC, 26 per cent identified a lack of security awareness among non-IT employees as a factor increasing the risk of successful cyberattacks. Another 24 per cent pointed to a lack of expertise among IT security staff.

 

Other factors identified by SMB respondents included outdated software or hardware, cited by 23 per cent, while 22 per cent each pointed to a lack of regular risk assessments and a lack of necessary security solutions.

 

This means cybersecurity is not confined to the work of an IT department. Employees who handle emails, documents, passwords, payments and company systems can also become part of the security chain.

 

Kaspersky recommends dedicated employee training to help staff identify threats such as deepfakes and vishing. Its recommendations also include clearer cybersecurity guidelines around browsing and passwords, as well as requiring IT approval for new software.

 

AI adds another layer to the security challenge

 

Artificial intelligence is emerging as both a cybersecurity tool and a source of additional risk for SMEs. The TTBS-CMR study found that 35 per cent of Indian SMEs view AI as an enabler for cybersecurity, while 34 per cent expect AI-powered threats to affect their businesses. This puts businesses in a situation where the same technology can potentially help security teams detect and respond to threats while also being used by attackers to increase the scale or complexity of attacks.

 

Similarly, Kaspersky also points to the growing use of AI by attackers. The company says threat actors are increasingly using artificial intelligence, contributing to both the volume and complexity of current threats. It also highlights credential protection as an important concern, as attackers target valuable login credentials that can be used to disrupt operations or steal data.

 

For smaller businesses, the challenge is that dealing with these threats can require specialist skills and continuous attention. Kaspersky says sophisticated attacks can bypass fragmented defences and that businesses can be held back by budget constraints and the shortage of information-security professionals. 

 

For Indian SMEs, the two reports together show a cybersecurity environment where the willingness to invest is growing, but security maturity is still uneven. Businesses are increasing budgets as attacks become harder to ignore, yet continuous monitoring, skilled personnel, employee awareness and changes to security practices after incidents remain areas that need attention.