Cybersecurity GCCs nearly double in India as global threats intensify

The number of cybersecurity GCCs in India has risen to 59 from about 30 in six years as global firms tap local talent for engineering, threat intelligence and security operations

The number of cybersecurity companies that have set up global capability centres (GCC) in India has almost doubled in the past six years from about 30 to 59, reflecting the country’s growing importance as a global hub for cybersecurity engineering, product development, threat intelligence and enterprise security operations.

 

While banks, retailers, and manufacturers have had a considerable presence in the country over the past decade and a half, the proliferation of cybersecurity companies show how these firms are looking at a fresh talent base and technical and domain expertise. Cyberattacks have grown manifold since the pandemic as hybrid working became prevalent and as agentic AI virtual agents have been deployed in the thousands across enterprises for automation and improving efficiency.

 

Almost 49 of the 59 companies are headquartered in the United States (US), accounting for approximately 83 per cent of India’s cyber GCC landscape, according to data from ANSR. US-headquartered cybersecurity firms also account for the overwhelming majority of recent additions, demonstrating India’s growing role in the global product, engineering, and innovation strategies of American cybersecurity companies. Israel is the second-largest source market, followed by Switzerland, Canada, the UAE, the Netherlands, the UK, and Japan.

 

Some of the major companies who have set up shop recently include Arctic Wolf, Sonatype, Deepwatch, Rapid7 and N-able. Established players include Palo Alto Networks, Fortinet, Zscaler, Sophos and CrowdStrike.

 

N-able, which started its GCC in Bengaluru in June, has about 100 employees to start, with plans to add another 50 by the end of this year. “We've already started to build the full-fledged architecture here, so we have full system design. I think that's an area that we continue to invest in. We continue to invest in AI threat research here so that is a really interesting opportunity for us,” said Mike Adler, chief technology and product officer. The centre will support a range of functions including engineering, product management, user experience, and security operations.

 

Some of the top functions delivered from such centres in India are application security and vulnerability management, cybersecurity risk assessment, cybersecurity governance, SOC operations and identity and access management.

 

That is a long journey for these centres from what they did a decade back, when they were primarily focused on execution and delivery accountability. Many of these GCCs also house their global leaders in India as cybersecurity became a boardroom priority instead of being confined just to the domain of the technology and information security officer.

 

This shift has made talent more readily available. India has a cybersecurity talent base of more than 325,000 with many working with startups or even freelancing for bug bounty programmes.

 

“Cybersecurity has emerged as one of the top emerging skills in demand for GCCs, alongside GenAI, AI/ML, data analytics, cloud computing, and RPA. India's GCC ecosystem is particularly attractive for cybersecurity operations given the country's improved cybersecurity infrastructure, compliance with the Digital Personal Data Protection Act (2023), and a vast pool of skilled cybersecurity professionals—with approximately 28 percent of global organizations having more than half of their cybersecurity teams based in India,” said Mubin Ebrahim Shaikh, partner, cyber security and technology consulting at EY.