When did anyone in a typical Indian office last stop and read a sender’s address properly before clicking a link? Not glance at it. Read it, letter by letter.

I’m guessing it’s been a while. I’m also guessing that’s not because people are careless. They’re busy. The inbox is full, a manager is pinging on WhatsApp, and the email says “urgent” in the subject line. Clicking is the path of least resistance, and attackers know that better than most HR teams do.

I usually skim statistics. They blur together after a while. A few from this year didn’t blur.

IBM’s 2026 Cost of a Data Breach Report found that the average breach in India now costs INR 25.5 crore, a 15.9% jump over last year’s INR 22 crore. Same report, another detail: phishing, including voice and SMS phishing, was the most common way attackers got in, at 19% of cases. Drive-by compromise and supply-chain attacks came next. You can read the India findings on IBM’s newsroom if you want the source.

Now look at the global picture. Verizon’s 2026 Data Breach Investigations Report says the human element was involved in 62% of breaches. And that isn’t a one-year blip. One analysis points out the figure has stayed between 60% and 74% across four consecutive reports. So it isn’t a trend that fades. It’s the baseline.

Here’s what bugs me. Sixty-two percent doesn’t mean 62% of employees are fools. It means people sit in the middle of almost every process attackers want to abuse: logging in, approving payments, sharing files, answering the phone. If a company’s defence plan has no real answer for that, it has a hole the size of a door.

People mix these things up all the time, so let me separate them.

Cybersecurity awareness is whether a person notices something is off. That’s it. A strange tone in an email from the “CFO”. A login prompt that appears right after a link click. A phone call from “the bank” asking for an OTP they supposedly need to cancel. Awareness is the pause before the click.

Training is the structured effort to build that pause. Risk management is the system around both, deciding where the pause matters most and what happens when it fails (because sometimes it will).

What awareness is not: a compliance checkbox. I’ve seen companies treat it that way, and the result is predictable. Everyone sits through forty minutes of video, answers a quiz with the right answers circled in the previous slide, and goes back to clicking whatever they want. The certificate gets filed. Nothing changes.

A better way to think about it is as muscle memory. Nobody learns to drive by reading a manual once a year. They practise, they make small mistakes in safe conditions, and eventually they brake without thinking. Security habits work the same way. Delphi Infotech describes its approach in similar terms, with engaging modules, real-world simulations and expert-led sessions meant to strengthen what they call the first line of defence. You can see how they frame it on their cybersecurity awareness training

India has a few quirks that make life easier for attackers, and none of them are insults. They’re just facts about how work happens here.

First, scale and speed. Digital payments, UPI, e-KYC and app-based everything mean people are used to quick, trust-based digital actions. That’s wonderful for convenience. It’s also exactly the habit a scammer wants to borrow. Second, a lot of Indian businesses run on a mix of modern tools and informal habits, such as passwords shared in WhatsApp groups, personal phones used for work, and approvals given by voice note. Third, plenty of small and mid-sized companies don’t have a full security team, so the “security person” is whoever is best with computers. Usually the same person who fixes the printer.

Then there’s the shift away from email. For years, awareness programmes were basically “don’t click weird links in your inbox”. Attackers moved on.

 A summary of the 2026 Verizon data notes that social engineering stays steady at 16% of breaches, but 41% of those now use channels other than email. The same data shows non-email phishing simulations got a higher median click rate than email ones. Translation: people have learned to be a bit suspicious of email, and attackers are already texting, calling and messaging instead.

Pretexting, where an attacker builds a believable story, is getting more attention too. It’s rising as a way into ransomware attacks, especially through help desk impersonation and callback phishing. Imagine a caller who sounds calm and polite, knows the employee’s name and manager, and just needs a quick password reset. That’s not a hacker movie. That’s a Tuesday.

Okay, this is the part where most programmes quietly fail. Let me say what I think works, and I’m opinionated about it.

Short beats long. Ten minutes every few weeks will outperform a three-hour session once a year, every time. People forget most of what they hear in long sessions anyway. Small, regular nudges stick.

Realistic beats generic. If employees in a finance team only see examples about Nigerian princes, they’ll learn nothing useful. They need to see the fake invoice that looks like their vendor’s, the supposed GST notice, the “your salary slip is ready” email. Training should look like the actual messy stuff those specific people deal with. HR sees different traps than accounts. Accounts see different traps than the sales team.

Practice beats lecture. Phishing simulations are useful here, but only if they’re handled kindly. The moment a simulation turns into a public shaming exercise, people stop reporting real attacks because they’re scared of looking stupid. And reporting is the thing that matters most. A company where employees say “hey, this looks weird” within five minutes is far safer than one where nobody clicks anything but nobody tells anyone either.

That leads to the thing I’d put at the top of any list: make reporting easy and safe. One button in the email client, or one phone number, or one chat channel. And then thank the person who used it. Seriously. Thank them. Even if it was a false alarm.

Coverage should go beyond email too. If the data says phone and messaging channels are where click rates are rising, then training has to include calls, SMS, QR codes and chat apps. A short drill like “someone from IT calls and asks for your OTP, what do you do?” teaches more than an hour of slides.

Leaders need to be in the room. I mean that literally. If directors skip the training, or demand exceptions to the password policy because it’s “inconvenient”, the message to everyone else is loud and clear. Culture follows what senior people do, not what the policy says. Verizon’s report makes a similar point, as quoted in one write-up: strong programmes need a culture that supports and enables secure behavior.

Here’s where I’d zoom out for a minute.

Training reduces the chance that someone slips. Cyber risk management accepts that someone eventually will, and asks the grown-up question: what then? How bad would it be, how fast would anyone know, and who does what in the first hour?

At its simplest, it’s a loop. Find what matters (customer data, payment systems, the ERP, the files that would end the company if lost). Work out how those things could be hurt. Decide which risks to reduce, which to accept, and which to hand to someone else, like through insurance or a managed service. Then check again, because things change every quarter.

Business continuity is a big piece of this and it gets ignored until the worst day. If a ransomware attack locks up the main server tonight, can the business still bill customers tomorrow? Is there a clean backup, and has anyone actually tested restoring it? I’d bet a surprising number of companies have backups they’ve never tried to restore. That’s like owning a fire extinguisher you’ve never checked. For more on how risk mitigation and continuity fit together, Delphi has a useful overview on their risk mitigation and business continuity.

The cost data backs up the value of preparation. IBM’s India findings show offensive security practices like red teaming and penetration testing cut breach costs the most, by an average of INR 2.47 crore. That’s a polite way of saying that finding your own weaknesses before attackers do pays off. The same report links AI and automation in security operations to lower costs, noting that organisations without them faced an average breach cost of INR 31.6 crore.

Third parties deserve a line of their own. With so many breaches touching a vendor or partner, risk management has to include questions like: who has access to our systems? What do they do with our data? What happens if they get breached? A simple vendor questionnaire and a short list of “critical suppliers” already puts a company ahead of most.

And then there’s the new problem, shadow AI. Employees paste customer details into free AI tools to save time, with no bad intent at all. IBM found that shadow AI added about INR 1.79 crore to the cost of a breach where it was present. A clear, sensible policy (“use these approved tools, never paste these types of data”) beats a ban that everyone quietly ignores. 

If the business case didn’t already convince anyone, the law might.

India’s Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, giving full effect to the DPDP Act of 2023. They set an eighteen-month period for phased compliance, which puts the full compliance date around May 2027. Some of the finer points of the phasing have been described differently by different advisers, so it’s worth checking the official text or asking a lawyer before locking in a plan.

The penalties are the part that gets attention. The government’s own summary says the highest penalty, up to ₹250 crore, applies when a data fiduciary fails to maintain reasonable security. Those are ceilings, not automatic fines, and the Data Protection Board is expected to look at things like the severity of the violation, the type and volume of data, the impact on people, and the steps taken to fix it. Still, “reasonable security safeguards” is a phrase that will get tested, and a documented training programme is one of the easiest ways to show a company took it seriously.

Breach reporting matters just as much. Guidance from compliance advisers says organisations must submit a detailed report to the Data Protection Board within 72 hours of discovering a breach. Seventy-two hours is not a lot when nobody knows who’s supposed to make the call. (And if the phrase “who’s supposed to make the call” gave you a small stomach-drop, that’s the point.)

Separately, CERT-In, India’s national cyber response agency, has had its own incident reporting rules in place since 2022, which require reporting certain incidents within six hours. The CERT-In website has the current directions. So between two regulators, a confused first hour can turn a bad day into a legal problem too.

The practical takeaway is boring but true. Employees need to know how to recognise a possible incident and who to tell, fast. That’s not a legal-team thing. That’s an awareness thing. The 72-hour clock starts when the company discovers the breach, and discovery often starts with one employee noticing something odd and speaking up.

Nobody fixes all of this in a week. Here’s the order I’d tackle things in, loosely, because real life never follows a neat checklist.

Start with a quick look at what exists. Is there any training at all? When was the last one? Is there a simple way to report a suspicious email or call? Ten honest questions with the IT lead and an HR person will reveal more than a fancy audit. Write down what’s missing, even if it’s embarrassing.

Next, decide what matters most. Pick the top handful of systems and data types, such as customer records, payment access, the email server, and shared drives. Think about who touches them. Those people get priority for training, since attackers go after the same people.

Then turn on the cheap stuff. Multi-factor authentication on email and key systems. A password manager instead of sticky notes. A single reporting channel. Basic backups that are tested, not just assumed. None of this is glamorous, and all of it matters more than most expensive tools.

By around the one-month mark, launch a first round of short training that matches real scenarios. Include at least one phone-based and one message-based example, not only email. Run a gentle phishing simulation a few weeks later and treat the results as information, not a scoreboard. Celebrate the people who report things.

In the second month, write a one-page incident plan. Who gets called? Who talks to customers? Who handles the regulators? Where’s the contact list stored, and is it somewhere that still works if email is down? Walk through it once as a tabletop exercise. Forty-five minutes, a few snacks, a made-up ransomware scenario. People remember these.

In the third month, review vendors with access to sensitive data, and set the shadow AI policy. Then pick two or three simple measures to track, like the percentage of staff who report simulated phishing, the average time from report to response, and the number of repeat clickers who’ve been coached. Skip vanity metrics like “training completion”, which says very little by itself.

Then repeat. That’s the secret, really. It’s not a project with an end date. It’s a habit.

• Most breaches involve people in some way. Verizon puts the human element at 62% for 2026, and the figure has been steady for years.

• Cybersecurity awareness is the pause before the click. Training builds it, and risk management plans for the day it fails.

• Attackers have moved beyond email into calls, texts and chat, so training has to cover those channels too.

• Short, regular, realistic training beats a yearly marathon. Easy, blame-free reporting matters even more.

• India’s average breach cost reached INR 25.5 crore in 2026, and the DPDP Rules add heavy penalties and a 72-hour breach reporting window.

• Vendors and shadow AI are growing risks, and a short policy plus a vendor check goes a long way.

Q: What is the difference between cybersecurity awareness and employee cybersecurity training?

A: Awareness is the mindset, meaning people notice and question suspicious things. Training is the structured way of building that mindset through short lessons, simulations and practice. Think of awareness as the outcome and training as the method. A company can run training and still lack awareness if the content is boring or unrealistic.

Q: How often should employees be trained?

A: There’s no magic number, but small and frequent works better than big and rare. A short session every month or so, plus a phishing simulation every quarter or two, is a reasonable rhythm for most teams. New joiners should get a basic session in their first week, before they’ve got access to anything sensitive.

Q: Do small businesses in India really need all this?

A: Yes, though it can be scaled down a lot. Small firms are often easier targets because they’ve got fewer controls but still hold valuable data and payment access. A password manager, multi-factor authentication, tested backups, one reporting channel and a few short training sessions cover the basics without a big budget. The DPDP Act also applies based on the data handled, not the company’s size, so it’s worth checking how it applies.

Q: What does cyber risk management include?

A: It covers identifying the systems and data that matter, working out how they could be harmed, deciding how to reduce or accept each risk, preparing a response plan, and reviewing it all regularly. Business continuity, vendor oversight and incident response sit inside it. Employee training is one control within that bigger picture.

Q: How do we know if training is working?

A: Watch behaviour, not attendance. Useful signs include more employees reporting suspicious messages, faster reporting times, fewer repeat clicks in simulations, and fewer real incidents caused by simple mistakes. If completion rates are high but reporting is flat, the content probably isn’t landing.