Small confession first. I used to think a cyber risk assessment was some guy in a suit running a scary scanner, then dropping a 90-page PDF that nobody ever opens. 

That's the bad version, though. A good one is boring. Really boring. Also way more useful.

Here's the kind of thing it catches. Your accounts person gets a mail saying a vendor changed their bank details. She updates it, because why wouldn't she? Two weeks later the actual vendor calls, a bit annoyed, asking where their money is. Nobody got "hacked" like in the movies, mind you. One email. That's all it took.

Three questions. What do we have that matters? What could hurt it? How bad would that be?

That's it, really. Everything else is just answering those properly instead of guessing.

You don't end up with some dramatic report. You end up with a list. Ranked. Every risk has a name next to it and a decision: fix it, shrink it, push it to an insurer, or leave it alone on purpose with a senior person nodding along.

People call this cyber risk management. Sounds very corporate, I know. It just means working out what to spend on first. You can't protect everything equally. Plenty of smaller firms just buy whatever the last salesperson pitched. Which, sure, is a strategy.

If you want a neutral guide on how the pros do it, the NIST Cybersecurity Framework is free and way easier to read than you'd expect. Also keep CERT-In bookmarked. They look after national incident response in India, and it's better to know their reporting rules before you ever need them.

Yeah, I know, it sounds like paperwork. Skip it, though, and the assessment either drags on for months or ends up checking the wrong stuff entirely.

Scoping is just drawing a line. Head office only, or the branches and plants too? Cloud accounts? The ERP? That mobile app a freelancer built three years ago and nobody has touched since? Pick, write it down, and move on.

Think about what you're protecting in plain business terms. For an online store, it's customer data and the checkout page. For a small NBFC, loan records and the app. For a factory, maybe the machines themselves, which often run software so old that nobody wants to restart them.

And get someone senior to say out loud that this matters. Otherwise, the IT team spends weeks chasing other departments and hearing "will send tomorrow." (Tomorrow never comes, by the way.)

Also jot down which rules apply to you. If you hold personal data, India's Digital Personal Data Protection Act, 2023, is relevant, and you should check where its rules stand for your sector right now. Banks, NBFCs, insurers and SEBI-regulated firms usually have regulator expectations on top. I'm not going to guess at specifics. Ask your compliance person or a lawyer.

This one catches people off guard. Nearly every company finds something it forgot it had.

An old test website that's still live. A cloud storage bucket from a project that ended two years ago. A login belonging to someone who left in 2022 and, funnily enough, still works fine.

So, make the list. Servers, laptops, phones that check work email, SaaS tools, databases, websites, payment gateways. And the shadow stuff, like the free tool somebody in marketing signed up for using their office email. Everyone has a few. Everyone.

Next to each thing, write who owns it and how much it matters. Low, medium, and high is plenty. The server with KYC documents or Aadhaar copies obviously ranks above the one hosting last year's event microsite. Data beats hardware. You can buy another laptop, but trust is a lot harder to rebuy.

Vendors go on the list too. Your CA firm, payroll provider, logistics partner, the ad agency. If their access to your data is sloppy, it's your problem, even though it's not your server.

Step 3: What could actually go wrong?

Now put yourself in the attacker's chair for a bit. Don't get paranoid, just be realistic about what actually shows up in Indian businesses.

Phishing, mostly. A fake mail pretending to be a vendor or a courier company or the GST portal. A WhatsApp message "from the MD" asking for an urgent transfer. Right beside that sits business email compromise, which is the vendor story I started with.

Then ransomware, where your files get locked and someone wants money to unlock them. It's hit hospitals, factories, tiny firms, pretty much everyone. The 2022 attack on AIIMS Delhi is probably the best-known public case. It showed how fast things stop when core systems go down.

And the usual suspects. Stolen passwords. Cloud storage left open to the entire internet. Software nobody patched. Now and then, an unhappy employee.

For each asset, ask which of these could realistically reach it. A public website faces different stuff than an internal accounts system. You're matching threats to assets, not writing a thriller.

Where a vulnerability assessment comes in

This is where a vulnerability assessment is handy. It's a sweep, mostly automated, across your systems, apps and networks, hunting for known weak spots. Missing patches. Old software. Bad settings. Ports sitting open for no good reason.

Step 4: Check the protections you already have

Controls are the safeguards you've already got. Password rules, multi-factor login, backups, firewalls, staff training, who can get into what, and a plan for when things break.

The catch is you have to check if they work, not whether they exist. A backup policy isn't a backup you've actually restored. MFA doesn't mean much if it skips the finance team's mailboxes and your admin accounts.

This part gets a little awkward, honestly. Somebody says, "yeah, we have that," and somebody else quietly goes "do we?"

For each high-value asset, I'd ask three simple things. Who can reach it? How would we notice if someone did something odd? How fast could we get it back if it vanished tonight? If a team watches your logs and alerts, in-house or through a managed security operations centre (SOC), write that down here. How fast you spot trouble changes how bad it gets.

And if you want a bigger-picture read on your security overall, not just one system, a cybersecurity maturity assessment works well next to the risk review.

Where penetration testing comes in

Penetration testing earns its place here. Skilled people, with your permission, try to break in the way a real attacker would. They string small weaknesses together and push on your controls to see what gives. You get an actual story of how a break-in would go, start to finish.

A vulnerability assessment says there are some unlocked windows. A pentest says I climbed through that one, walked into the server room, and copied your customer database. Much more convincing in a boardroom, by the way.

Penetration testing vs a risk assessment (and where VAPT fits)

People mix these up all the time, so I'll be blunt. The risk assessment is the big picture: your business, your assets, what matters most. Penetration testing and vulnerability assessment are technical checks that feed into it.

Think doctor. The overall health review is the risk assessment. Blood work and scans are the VAPT. Blood work can't tell you about your lifestyle, and a chat about your lifestyle can't tell you your cholesterol. You need both.

VAPT just means vulnerability assessment and penetration testing bundled together. If you want to see what usually gets tested, our VAPT services page covers it.

The order that makes sense to me: risk assessment first so you know what's critical, targeted VAPT on those systems next, then back to the register to update it with whatever the tests turned up.

What this looks like in Indian businesses (made-up, but realistic)

These aren't real clients. Just scenarios I reckon are close to the real thing.

Say you run an online fashion brand out of Bengaluru. Website, payment gateway, customer database, a couple of courier integrations. You'd worry about checkout tampering, stolen customer data, and hijacked admin accounts. A vulnerability assessment on the site, a pentest on checkout and the admin panel, and phishing training for the support team, because they open mails from strangers all day.

A mid-sized manufacturer in Gujarat is a different animal. The sensitive systems aren't only office computers. They're the machines on the production floor, likely old and rarely updated. If the line stops, that can cost way more than a data leak. So you'd look hard at how well office IT is separated from the factory side, and what happens if the ERP is down for three days.

What you should end up with (and who actually does the work)

A decent assessment leaves you with real things in your hands. Not just a feeling that something got done.

Mainly, you want a scope note so everybody remembers what was covered, an asset list with owners, a rundown of threats and weak spots, a look at where your controls fall short, and the risk register itself with ratings and decisions. On top of that, a short action plan, with names and dates. If a pentest was part of it, there's a separate technical report on what was found and how to fix it, plus a version for people who'd rather not read technical details.

Who does what? It gets messy if nobody decides early. Leadership sets how much risk is okay, approves the money, and signs off on anything being accepted. Whoever runs IT or security drives the process and chases the fixes. Department heads own the data and systems in their area because they know what really matters day to day. HR and legal come in for people, contracts, and compliance.

And an outside team is worth having, mostly because they don't share your habits. After a while, everybody in a company stops seeing the weird old server in the corner. A fresh pair of eyes still does.

How often should you redo it?

Once a year, minimum. That's the usual advice, and it's fair enough. But your business doesn't sit still between reviews, so yearly alone won't cut it.

Redo it when something big shifts. New cloud provider. New app launch. A merger. A key vendor change. An incident, or even a near miss. New rules that apply to you. Any of those is reason enough.

In between, run lighter checks. Vulnerability scans are done every quarter or after major releases. Penetration testing at least yearly for critical systems and after big changes. One proper check-up a year, a few smaller ones along the way.

The good and the bad of doing it properly

The good stuff is real. Money goes where it counts. You can explain your decisions to the board, auditors, clients, and insurers with evidence instead of vibes. Silly gaps get caught early. And bigger customers who send you security questionnaires tend to trust you more.

The bad stuff, I won't pretend otherwise. It eats people's time, and people are already busy. It's uncomfortable since it shows things nobody wanted to look at. The snapshot goes stale quickly if you don't update it. And if you do the whole exercise and never act on it, you've basically paid to feel guilty.

I still think it's worth it. Only if you follow through, though.

Mistakes I keep seeing

Treating it as a one-off project. Doing it only to tick a compliance box. Forgetting vendors and cloud accounts. Marking everything "high" because nobody wants the blame, which makes the ranking useless.

And my favourite: buying an expensive tool first and working out the problem afterwards. Start with the questions. Tools can come later.

If you take one thing from all this, let it be that it doesn't have to be big or perfect. A modest, honest look at your five most important systems, done this quarter, beats a gorgeous framework that never leaves the planning stage.

Key takeaways

•  A cyber risk assessment answers three questions: what matters, what could go wrong, and how bad would it be.
• Scope first. Decide what's in and out, and get leadership behind it.
• Build a real asset inventory, including data, vendors and forgotten shadow tools.
• Match realistic threats like phishing, ransomware, payment fraud and stolen logins to your assets.
• A vulnerability assessment finds known weaknesses broadly. Penetration testing shows what an attacker could actually do.
• VAPT feeds into a risk assessment. It doesn't replace one.
• Give every risk an owner, a deadline and a decision: reduce, avoid, transfer or accept.
• Reassess at least yearly, and after big changes like new apps, vendors, mergers or incidents.
• Check your own sector regulator's requirements directly instead of relying on generic checklists.

Frequently asked questions

How do you do a cyber risk assessment step by step?

Start with scope. Decide which systems, locations, and data are in. Then list your assets and mark how much each one matters. After that, work out the realistic threats and hunt for weak spots, using vulnerability assessments and, for the critical systems, penetration testing. Check whether your current controls actually work. Then score each risk on likelihood and impact, pick what to do (reduce, avoid, transfer, or accept), give every item an owner and a deadline, and keep it all in a risk register you actually go back to.

What's the difference between VAPT and a risk assessment?

A risk assessment looks at the whole business and decides which risks matter most and what to do about them. VAPT, short for vulnerability assessment and penetration testing, is a set of technical tests that find and prove weaknesses in specific systems. The results go back into the risk assessment. So one is the strategy, and the other is the evidence. Most organisations need both.

What deliverables should a risk assessment produce?

You should get a scope statement, an asset inventory, a summary of threats and vulnerabilities, a control gap review, a risk register with ratings and decisions, and a prioritised action plan with owners and timelines. If penetration testing is included, ask for the technical findings report and an executive summary too.

Do small Indian businesses really need this?

Yes, though it can be lighter. Smaller firms often get picked on precisely because their defences are thinner and attackers assume nobody's watching. A focused look at your handful of critical systems and key vendors is a sensible place to start.

In early 2023, a group of engineers at Samsung pasted proprietary source code into ChatGPT. They were trying to work faster, debug more efficiently, and move a project forward. Within 20 days of the company allowing its staff to use the tool, three separate incidents had resulted in confidential source code, equipment diagnostics data, and internal meeting transcripts being fed into OpenAI’s model.

There was no hacker. No phishing email. No compromised password. Just employees doing what their instincts told them: use the best tool available to get the job done.

That data is now absorbed into a third-party AI model. There is no undo button.4

"The issue isn't malicious intent. It's contextual blindness.", Technology & Work Survey, 2025

If that can happen at Samsung, one of the world’s most sophisticated technology companies, the question we need to ask is straightforward: what is happening inside Indian enterprises right now?

We believe the answer is: more than most security leaders realise.

Generative AI adoption is accelerating faster than security governance can keep pace. According to a 2025 Menlo Security report, 73% of organisations in India have already implemented GenAI tools, one of the highest adoption rates in the Asia-Pacific region. Web traffic to GenAI platforms jumped 50% in a single year, reaching 10.53 billion visits globally in January 2025 alone.

But the security infrastructure to govern that adoption is largely absent. Consider what the data tells us:

• 86% of CISOs globally worry their employees are leaking sensitive data through GenAI platforms (Mimecast 2024 Data Exposure Report).
• 48% of employees have admitted to uploading sensitive corporate data into public AI tools (Technology & Work Survey, 2025).
• 1 in every 35 GenAI prompts carries a high risk of sensitive data leakage, affecting 87% of organisations that use GenAI regularly (Check Point, November 2025).
• 68% of organisations have already experienced data leakage incidents related to employees sharing sensitive information with AI tools (Metomic, 2025 State of Data Security Report).
• Shadow AI, the use of unauthorised AI tools outside IT oversight, now accounts for 20% of all enterprise breaches and adds an average of ₹4.74 million per breach compared to ₹4.07 million for standard incidents (IBM Cost of a Data Breach Report, 2025).

The Indian enterprise landscape carries specific characteristics that amplify GenAI data leak risk beyond what global benchmarks suggest.

High AI adoption, low governance maturity

India ranks among the fastest GenAI adopters in Asia, but governance is lagging dramatically. According to BW Businessworld’s 2025 cybersecurity analysis, shadow AI, prompt-based data leakage, and the misuse of public LLMs were identified as the most urgent governance blind spots of 2025 across Indian enterprises, particularly in BFSI, IT services, healthcare, and manufacturing sectors.

A workforce optimised for productivity over process

India’s digital workforce is young, fast-moving, and motivated to find efficiency gains. These are strengths, but they also mean that when a better tool exists, employees will find and use it. Gartner’s November 2025 survey of cybersecurity leaders found that 69% of organisations already suspect or have evidence that employees are using prohibited public GenAI tools.

The DPDP Act 2023, and penalties that are now live

India’s Digital Personal Data Protection Act (2023) received Presidential assent on 11 August 2023. The implementing DPDP Rules were notified on 13 November 2025, operationalising the full enforcement framework. Full Schedule 1 penalties are effective from May 2027, giving organisations a narrow window to achieve compliance.

The penalties are substantial:

• ₹250 crore for failure to implement reasonable security safeguards (Section 8(5))
• ₹200 crore for failure to notify the Data Protection Board or affected Data Principals of a breach (Section 8(6))
• ₹200 crore for non-compliance with provisions protecting children’s data

An employee sharing customer PII, names, phone numbers, email addresses, financial records, through a public GenAI platform could constitute a reportable breach under the Act. The clock is ticking.

It would be comforting to think that employees are only sharing harmless queries with GenAI tools. The data suggests otherwise.

An analysis of over one million GenAI prompts and 20,000 uploaded files across more than 300 GenAI applications (Help Net Security, Q2 2025) found that:

• 22% of uploaded files contained sensitive information, including source code, proprietary algorithms, M&A documents, customer records, and internal financial data.
• 4.37% of prompts contained sensitive data, a figure that sounds small until it is applied to a workforce of thousands generating hundreds of prompts daily.
• Customer data, including billing and authentication information, made up the largest share of leaked data at 46% (Harmonic Security, Q4 2024 analysis).
• Employee PII and payroll data accounted for 27% of sensitive prompts.
• Legal and financial data made up 15%.

Among Mimecast’s tracked data, the most frequently shared data types by enterprise employees in ChatGPT per 10,000 users monthly include source code (158 instances), regulated data (18 instances), intellectual property (4 instances), and passwords and credentials (4 instances).A structured approach to information protection is the most direct way to close these leakage gaps.

1. Loss of competitive advantage

Your product roadmap, client pipeline, pricing strategy, and R&D plans are worth more than most organisations realise, until a competitor has access to them. GenAI platforms trained on even fragments of your confidential presentations or strategy documents can surface that intelligence in unexpected ways. In early 2025, a London-based pharmaceutical company suffered a significant IP breach when researchers used a public GenAI tool to analyse proprietary drug discovery data. Similar molecular structures and insights subsequently appeared in a competitor’s patent filings.

2. DPDP, GDPR, and regulatory exposure

India’s DPDP Act is now enforceable. For organisations with clients in the EU, HIPAA (US healthcare), or CCPA (California consumer data), the regulatory exposure compounds across jurisdictions. A single employee sharing customer PII through an unsanctioned GenAI tool can trigger a reportable breach across multiple frameworks simultaneously. Under GDPR alone, cumulative fines had reached approximately $6.17 billion by January 2025, with LinkedIn fined $326 million and Uber $305 million in 2024 for data handling violations.

3. Reputational damage that outlasts the breach

Trust, once broken, is extraordinarily expensive to rebuild in the enterprise context. India has seen high-profile breaches at Hathway (41.5 million customers, March 2024), boAt (7.5 million customers, February 2024), and BSNL. In each case, the reputational fallout extended far beyond the immediate incident. A data breach involving customer financial records or confidential business data can undo years of relationship-building in days, with social media amplifying the story faster than any PR team can respond.

4. Fuelling the next generation of phishing attacks

Most organisations in India currently rely on legacy Data Loss Prevention tools that were designed before generative AI existed. These tools were architected around a different threat model: email attachments, USB drives, and structured data egress. They were not built to monitor what an employee types into a browser tab.

The limitations are structural, not incidental:

• No browser visibility: Legacy DLP cannot intercept or monitor prompts entered into web-based AI tools like ChatGPT or Gemini.
• Alert fatigue: Traditional tools require constant tuning, generate enormous alert volumes, and drain analyst bandwidth, in an industry already experiencing critical talent shortages.
• Months-long deployments: Legacy platforms can take six months or more to configure before they provide meaningful protection, by which time the threat landscape has shifted.
• Policy-first architecture: They require organisations to know exactly what they are looking for before they can find it, a fundamental mismatch with the emerging, unclassified nature of GenAI data leakage.

Organisations have responded with blunt instruments. According to Cisco’s 2024 Data Privacy Benchmark Study: 63% have set restrictions on data input into AI platforms, 61% limit which AI tools employees can use, and 27% temporarily banned GenAI applications entirely. The problem with the ban approach is well-documented: it does not stop usage; it pushes it underground. Shadow AI use grows when restrictions are imposed without an approved alternative.

The answer to GenAI data risk is not to ban AI, it is to build a security posture that moves with how your teams actually work. We recommend a five-pillar approach for Indian enterprises:

1. Detect without disrupting. Deploy solutions that provide visibility into data movement across cloud, endpoint, browser, and GenAI channels without requiring months of policy configuration. The goal is to surface both known and unknown risks from day one. Solutions like Mimecast Incydr provide this visibility across Git activity, Salesforce downloads, cloud syncs, Airdrops, and browser-based AI tool usage in a single view.

2. Educate at the moment of risk. Quarterly awareness training is insufficient. When an employee attempts to paste source code into ChatGPT, the most effective intervention is a real-time micro-training triggered at that exact moment, not a session they completed six months ago. Integrated micro-training tools, including Mimecast Instructor, automate responses to low-severity risk events and reduce event volume over time.

3. Contain and investigate fast. User error is inevitable. When an incident occurs, speed of containment determines the scale of damage. Security teams need tools with swift containment controls that enable rapid investigation and closure. Mimecast Incydr enables 50% faster incident closing, per a commissioned Forrester Research report.

4. Block selectively for high-risk users. Real-time blocking is not appropriate for the entire organisation, that path leads to shadow IT. But for employees working directly with intellectual property, source code, or regulated customer data, real-time blocking tied to behavioural risk scoring is a proportionate and necessary control.

5. Upgrade your DLP infrastructure. Modern Data Loss Prevention solutions purpose-built for the GenAI era provide complete visibility into cloud exfiltration, validate actual file contents to determine sensitivity, and deploy in days rather than months. The ROI is measurable: organisations deploying Mimecast Incydr see an average 172% return on investment, including data loss savings exceeding $680,000 and a 50% reduction in incident closure time.

Shadow AI is not a future risk. It is operating inside Indian enterprises today.

Over 80% of employees globally use unapproved AI tools. 665 distinct generative AI applications have been tracked across enterprise environments (Vectra AI, 2025). In India specifically, 68% of employees use free-tier AI tools that bypass enterprise controls (Menlo Security, 2025). The WEF Global Cybersecurity Outlook 2026 found that CEOs now rank GenAI data leaks as their number one security concern, ahead of ransomware, ahead of nation-state actors.

As an authorised Value-Added Distributor (VAD) for Mimecast in India, we work with security teams across Indian enterprises to evaluate, pilot, and deploy Mimecast’s data security solutions, including Mimecast Incydr, the cloud-native insider risk and data loss protection platform.

Our engagements typically begin with a GenAI Data Risk Assessment, a structured 30-minute conversation to help your team understand your current exposure, identify the highest-risk data flows in your environment, and map a practical path to remediation. There is no obligation and no lengthy sales process.

• 73% of Indian enterprises have implemented GenAI tools, but governance and security controls have not kept pace with adoption.
• Sensitive data is already flowing into public AI platforms daily: source code, customer PII, financial records, credentials, and intellectual property.
• India’s DPDP Rules (November 2025) impose penalties of up to ₹250 crore for failure to maintain reasonable data security safeguards.
• Legacy DLP tools have no visibility into browser-based AI tool usage, the most common vector for GenAI data leakage.
• Banning AI drives usage underground, creating shadow AI and worsening the risk picture. The solution is governed, secure AI adoption.
• Modern solutions like Mimecast Incydr deploy in days, provide cross-channel visibility, and deliver measurable ROI, including 50% faster incident closure and 172% average ROI.
• Delphi Infotech offers a complimentary GenAI Data Risk Assessment for Indian enterprises. Reach out at info@delphiinfo.com or visit delphiinfo.com.

Q: What types of data are most commonly leaked through GenAI tools in enterprise environments?

A: Based on analysis of enterprise GenAI usage, the most frequently leaked data types include source code (the single largest category), customer data including PII and billing information (46% of sensitive prompts), employee data and payroll information (27%), and legal and financial data (15%). In ChatGPT specifically, Mimecast data shows 158 source code sharing instances per 10,000 enterprise users monthly.

Q: Does India’s DPDP Act apply to employee data shared through ChatGPT?

A: Yes. The DPDP Act 2023, now fully operationalised with the DPDP Rules notified in November 2025, applies to the processing of personal data of individuals in India. If an employee shares customer names, phone numbers, addresses, email addresses, or any other personal data through a public GenAI platform, this likely constitutes processing of personal data outside an approved, governed environment, creating compliance exposure under the Act. Penalties can reach ₹250 crore for failure to maintain reasonable security safeguards.

Q: Is banning GenAI tools an effective security measure?

A: Banning AI tools rarely works in practice. Research consistently shows that employees continue using prohibited tools, simply through personal accounts and unapproved channels, creating shadow AI that is invisible to security teams. Cisco’s 2024 Benchmark Study found 27% of companies have temporarily banned GenAI, but Menlo Security data shows 68% of employees still use free-tier AI tools despite restrictions. The more effective approach is building a governed, secure framework for AI usage that enables productivity within appropriate guardrails.

Q: What is shadow AI, and why is it more dangerous than traditional shadow IT?

A: Shadow AI refers to the use of generative AI tools by employees outside of IT-approved and security-monitored channels. It is more dangerous than traditional shadow IT because it requires no technical skill to implement, just a browser and an internet connection, and because the nature of GenAI interaction (pasting documents, entering queries, uploading files) directly exposes sensitive data. Shadow AI now accounts for 20% of enterprise breaches and adds ₹52 lakh on average to breach costs, according to IBM’s 2025 Cost of a Data Breach Report.

Q: How quickly can a modern data security platform like Mimecast Incydr be deployed?

A: Mimecast Incydr deploys in approximately two weeks, compared to the six-month-plus timelines typical of legacy DLP platforms. It requires no complex policy management or lengthy configuration. Per a commissioned Forrester Research report, the solution pays for itself within six months of deployment, with an average 172% return on investment and data loss savings exceeding $680,000. Incident closure time improves by 50% compared to pre-deployment baselines.

Q: What is a GenAI Data Risk Assessment, and how do we get one?