The rise in cyberattacks and the weaponisation of artificial intelligence is worrying boards and managements, allowing criminals to exploit vulnerabilities buried in decades-old technology systems and putting sensitive data, important business operations and supply chains at risk, leading to a fresh wave of mandates for cybersecurity consultants.
In India, State Bank of India disclosed that 375,000 customer records had been leaked on the dark web, while vulnerabilities in eMudhra’s digital certificate keys exposed websites to potential attacks. Globally, a critical vulnerability in the PHP programming language put an estimated 70% of internet infrastructure at risk, triggering millions of exploit attempts within 24 hours of its discovery and prompting countries including Germany, Hungary and Belgium to shut down websites as a precaution.
The North Korea-linked Binance hack, in which attackers exploited a compromised employee’s computer and an internal AI tool, and cyberattacks on supermarket refrigeration systems across at least eight European countries that pushed freezer temperatures to 55°C, again put a spotlight into how cyber threats are increasingly extending beyond data theft to disrupt physical infrastructure and supply chains.
Cyber experts at the Big Four, the largest players in the cyber security market, say geopolitical tensions, AI-driven threats and vulnerabilities in legacy systems are converging to create a more complex cyber risk landscape, making attacks harder to anticipate and contain.
“Cybersecurity and AI risk have moved onto the board agenda, with clients increasingly concerned about sophisticated attacks and risks from AI adoption. Cybersecurity mandates are becoming broader and more complex,” said Siddharth Vishwanath, risk consulting leader, PwC India.
They say companies face a two-front battle: AI is empowering attackers while organisations deploy AI systems and autonomous agents that require constant monitoring, governance and security to prevent misuse.
“AI is changing the speed and scale of the threat landscape. Vulnerabilities that have existed for decades are now being uncovered. Companies are trying to innovate with AI while simultaneously figuring out how to protect themselves against the risks it creates,” said Raghavendra BV, deputy cyber leader, EY.
The threat is also extending beyond individual vulnerabilities to interconnected systems. AI is allowing attackers to identify and combine weaknesses that may appear relatively harmless when assessed separately, turning them into pathways for wider breaches.
“AI is becoming a force multiplier for cybercriminals. Vulnerabilities that may individually be classified as low or medium risk can now be chained together and exploited much faster, allowing attackers to automate the entire attack lifecycle. The challenge for companies is no longer just preventing a breach, but being prepared to contain it and recover quickly,” said Gaurav Shukla, leader-cyber, Deloitte South Asia.
Now the boards and managements are discovering that the problem is compounded by decades of incremental technology expenditures that have left organisations operating complicated, interconnected systems, frequently with layers of outdated apps and infrastructure. The cost of replacing these systems is high, and it can also interrupt operations and leave open vulnerabilities.
HfS Research estimates the Global 2000 are carrying $1.5-2 trillion in accumulated technical debt from legacy systems. Over 70% of transformation budgets are allocated to just maintenance of these systems and these costs outpace innovation spending by 2x to 7x.
“The problem is no longer just that companies have vulnerabilities; it is that decades of incremental technology investments have created complex, interconnected systems in which a weakness in one layer can expose the entire architecture. AI is making those weaknesses easier to find and faster to exploit,” said Sivarama Krishnan, former Asia-Pacific cyber security services leader, PwC.
A big growing imperative is helping corporations get controls over AI agents. Consultants are being asked to review how the systems work, what information they can access and what precautions are needed to prevent things going wrong.
“Clients want visibility, observability and a reasonable degree of assurance that basic safeguards are working,” Raghavendra said.
The surge in demand is visible across specialised areas of cybersecurity. EY estimates that demand for AI security services has increased more than tenfold over the past year, although the market was only beginning to take shape a year ago. Data privacy mandates have more than doubled following the Digital Personal Data Protection Act, as companies, particularly in financial services, work towards compliance.
According to Gartner, worldwide spending on information security reached $213 billion in 2025, up 10.4% from 2024. This is expected to increase another 12.5% to $240 billion in 2026.
The growing sophistication of attacks is also forcing companies to move beyond security by design towards resilience by design.
According to consultants, the emphasis is changing away from avoiding every possible breach and toward ensuring that attacks are controlled, damage is reduced, and vital operations are promptly restored.
“Organisations need to move beyond security by design and start thinking about resilience by design. They must work with the assumption that a breach will happen and be prepared to contain it, limit the damage and restore operations quickly. Resilience has to be built into every product, programme and project from the outset,” Shukla said.
According to EY’s Raghavendra, operational technology (OT) security, covering the industrial systems that control factories, manufacturing processes and critical infrastructure, is another fast-growing area. These systems have traditionally received less cybersecurity attention than corporate IT networks. Companies have often been reluctant to upgrade them because they continue to function and any intervention could disrupt production. That approach is evolving as corporations recognise that a compromise in industrial systems can halt production and disrupt supply networks.
“Demand in OT cybersecurity has nearly doubled,” Raghavendra said.
The risks are particularly acute in sectors such as pharmaceuticals, where outdated operating systems and legacy equipment can leave production facilities exposed.
The shift is also intensifying demand for specialised talent.
EY has more than 5,000 people in its cybersecurity practice, including digital risks, in India and is looking to expand its pool of specialists, particularly AI security architects. Deloitte’s cyber practice has close to 3,000 professionals serving domestic clients, with heavy investments being made in building capabilities in AI red teaming, AI security architecture and AI governance and risk management.
Experts say that despite rising investments, companies continue to suffer breaches because spending does not necessarily translate into effective protection.
Consultants are increasingly being called to help companies quantify their exposure and prioritise investments according to the potential financial impact of an attack, rather than attempting to fix every vulnerability.
“The problem is not always the absence of spending but the allocation of that spending,” Raghavendra said.
The recent AI enabled attacks also have regulatory implications for financial institutions.
Therefore, the regulatory conversation is shifting from “Do you have cyber controls?” to “Can you demonstrate that you know your critical assets and emerging exposures, detect an attack early, contain it quickly, recover critical services, manage ecosystem risk, and provide evidence that management and the Board are actively governing that resilience.
“Cybersecurity is not just about buying tools. It requires the right processes, people and platforms to make those tools effective,” Raghavendra said.
