IMC 2026: 'AI for security, security for AI' becomes new cyber battleground

As India scales digital infrastructure under the 'Scale Without Boundaries' theme, cybersecurity is emerging as a parallel priority, with AI accelerating both attacks and defence

At the India Mobile Congress (IMC) 2026, the conversation around India’s technology ambitions is not only limited to faster networks, 6G, AI or connected devices. As India pushes ahead with its ‘Scale Without Boundaries’ vision, another question is gaining importance: how secure will this digital expansion be?

 

Cybersecurity has emerged as a prominent theme at the 10th edition of IMC, with the event dedicating a separate Suraksha pillar to strengthening trust. While cybersecurity companies are using the exhibition floor to demonstrate how attacks could play out across telecom networks, enterprises and connected devices. With Fortinet, Jio Quantum, Nokia, Ericsson, Cisco and KPMG in India showcasing or discussing solutions around AI security, network protection, Zero Trust, quantum-safe security and enterprise cyber risks.

 

 

Fortinet, the cybersecurity company and cybersecurity partner at IMC 2026, has taken that message a step further with an interactive experience, allowing visitors to participate in simulated attacks and defence scenarios.

 

The emphasis comes at a time when Prime Minister Narendra Modi, while inaugurating IMC on October 8, called for a global framework to tackle cyber fraud and deepfakes, arguing that digital threats increasingly cross national boundaries. As India connects more people, businesses, machines and services, the attack surface is expanding at the same time.

 

From telecom security to security for AI

 

Speaking to Business Standard at IMC, Fortinet India’s interim country manager Kaushtubh Deshmukh said the company was showcasing cybersecurity products covering telecom, operational technology and security operations, with AI forming a common layer across these areas.

 

“At IMC, we are showcasing most of the cybersecurity products which cover telecom, operational technology and security operations. All these, with a broad platform of AI,” Deshmukh said.

 

Fortinet has divided its presence across two experiences. One focuses on its products and hardware, while the second is built around cyberattack simulations.

 

The latter is designed to make cybersecurity less abstract for visitors. Participants can take the role of either an attacker or defender and see how a cyber incident unfolds, including scenarios involving zero-trust security and security operations centres.

 

The company is also running three batches of its cyber defence game every day. Participants receive tasks and are scored based on how well they perform, with awards for those who rank highly.

 

The idea reflects a larger shift in cybersecurity: defending digital infrastructure is no longer only about deploying a firewall or endpoint product. Organisations increasingly need to understand how multiple layers of infrastructure interact when an attack takes place.

 

The smartphone is becoming a bigger security battleground

 

For India, however, Deshmukh sees a more basic and widespread vulnerability: the smartphone. “Mobile is the biggest hit because the real estate on the screen is very less. It is only three inches by six inches. There are links that come across on WhatsApp and there are toolkits that get downloaded.

 

India’s enormous mobile user base makes smartphones an attractive entry point for attackers. A malicious link, a fake message or an APK downloaded outside trusted app stores can potentially turn a personal device into a gateway to sensitive information.

 

The risk is amplified because the smartphone has increasingly become the centre of a user’s digital identity. Banking, payments, authentication, email and government services can all be connected to the same device.

 

Deshmukh illustrated the problem through a rural-use case, where a family member may hand a phone to a child or another user who inadvertently clicks on a malicious link and downloads an APK.

 

“His phone is hanging. All the OTPs, passports, everything comes on the phone. The accounts are high, because everything is linked to the phone,” he said.

 

This also highlights a challenge that is different from simply deploying better security technology. India has to combine technology with awareness, particularly as digital services reach users with varying levels of cybersecurity awareness.

 

AI has compressed the time between attack and exploitation

 

The threat is becoming more difficult because attackers now have access to AI. According to Deshmukh, the pace at which cyberattacks can be prepared and executed has changed considerably compared with last year.

 

“The spirit at which the attacks were coming across and exploiting was far lesser and now it is multifold. An attack can be generated, curated and exploited within minutes.”

 

That speed is changing the economics of cybercrime. An attacker no longer necessarily needs to spend large amounts of time manually creating phishing material, identifying targets or modifying malicious content. AI can help automate parts of that process, allowing attacks to be generated and adapted faster.

 

But the same technology is increasingly being used on the defensive side.

 

Deshmukh said Indian enterprises are increasingly looking at two related questions: how to protect themselves against AI-enabled attacks and how to use AI within their own cybersecurity operations.

 

“If I have to put it short, it would be AI for security, security for AI.”  The distinction is important. Organisations are not only securing conventional IT infrastructure anymore. They are also having to secure AI models, AI applications and increasingly autonomous systems that can interact with enterprise data and other software.

 

Why cybersecurity cannot be bought in pieces

 

The growing threat is also exposing another problem, particularly for smaller businesses: cybersecurity remains fragmented. Deshmukh said companies often approach security by purchasing individual products to solve individual problems.

 

“Cybersecurity is the most fragmented field. Every single OEM comes saying that we can solve one problem. Nobody is looking at it as a platform.”

 

For smaller enterprises, this can become particularly difficult. A business may need protection for endpoints, networks, cloud environments, identities, applications and data, but may not have the money, expertise or personnel to manage multiple disconnected systems.

 

Deshmukh argued that cybersecurity therefore needs to be treated as a platform rather than as a collection of individual products. “There is no silver bullet for cybersecurity. It has to be a platform.”

 

That approach is becoming increasingly relevant as businesses move between cloud, on-premise infrastructure, mobile devices, IoT systems and AI applications.

 

Security budgets are rising, but so is the complexity

 

Despite concerns among smaller companies about the cost of cybersecurity, Deshmukh said he does not see cybersecurity budgets shrinking. He said companies may be cutting costs elsewhere or changing how they deploy infrastructure, but cybersecurity itself continues to receive attention.

 

According to Deshmukh, the share of IT budgets allocated to cybersecurity has moved from around 6.5 per cent last year towards 8-8.5 per cent.

 

The challenge now is not simply spending more. It is spending on systems that can work together and respond quickly enough to increasingly automated attacks. 

 

India’s scale creates a different cybersecurity challenge

 

There is also a significant gap between India’s urban digital ecosystem and the country's less connected or less digitally literate populations.

 

Deshmukh pointed to the contrast between metropolitan India and communities farther away from major cities.

 

“If you go 60 kilometres out of Delhi, you'll see a different India. But still, mobiles are there.”

That combination, high mobile penetration alongside uneven cybersecurity awareness, creates a distinctive risk.

 

India’s digital expansion has brought smartphones and digital services to a large population, but awareness about malicious links, APK files, impersonation scams and social engineering has not necessarily expanded at the same speed. This is where cybersecurity becomes more than an enterprise technology issue. It becomes part of the infrastructure required to make digital inclusion sustainable.

 

Zero trust becomes critical as telecom gets smarter

 

The challenge becomes even more complex as AI moves deeper into telecom networks.

As networks become increasingly software-defined and automated, the number of systems, applications and agents interacting with one another is likely to grow. Deshmukh said organisations cannot simply assume that a system or user is trustworthy because it is already inside the network.

 

“You can't trust anyone. You have to take an approach which is absolute zero trust.”

 

As AI systems become capable of taking actions rather than merely generating responses, the consequences of a compromised or misused agent could become larger. Guardrails, identity controls and continuous verification therefore become important parts of securing AI-enabled telecom and enterprise environments. 

 

The next threat may come from AI meeting quantum

 

Fortinet is also looking beyond today’s AI threat landscape. Deshmukh said the company is investing heavily in AI and hardware-based security and highlighted the intersection of AI and quantum technologies as an emerging concern. “AI plus quantum is going to be a very big threat.”

 

The immediate cybersecurity challenge for India may still be malicious links, identity theft, ransomware, fraud and attacks on enterprises. But the industry is increasingly preparing for a future in which advances in computing power can change the nature of both attacks and defence.

 

That makes the cybersecurity message at IMC 2026 particularly relevant to the event's larger theme.

 

“Scale Without Boundaries” is fundamentally about expanding India's digital infrastructure and technology capabilities. But that expansion also means more devices, networks, applications, data and AI systems to protect.