Have you ever actually counted how many things in your office or factory are connected to the internet? Try it sometime. You'll start with laptops and phones, feel pretty good about yourself, and then remember the biometric attendance machine, the smart AC, the CCTV box in the corner, and that one printer nobody admits owns a Wi-Fi card.

That's the thing about modern work. Everything talks to everything. It's convenient, it saves money, and it quietly hands attackers about forty new doors to try.

The question is simple. If someone broke in tonight, would you know?

Not "would your IT guy eventually notice something odd next Thursday." Would you actually know, soon enough to do something about it? Most small and mid-sized businesses I read about honestly can't say yes. And I don't think that's because people are careless. It's because security used to be a locked-door sort of thing. You had a server room, a firewall, and maybe a guard at the gate. The edge of your business was a physical place.

Now the edge is wherever a sensor, a vendor login, or an employee's personal phone happens to be. A temperature sensor on a production line in Pune can be a way in. A contractor's laptop in another city can be a way in. A password that leaked three years ago on some shopping site can be a way in.

So when I say cyber risk management, I'm not talking about buying one clever box. I'm talking about getting honest about where your doors are, which ones are unlocked, and what happens if somebody walks through. That's really all the fancy phrase means. Everything else is detail.

I don't love stats dumps, so I'll keep this short. But a few figures stuck with me.

Seqrite's India Cyber Threat Report 2026 counted roughly 265.5 million threat detections across India between October 2024 and September 2025, with engineering and manufacturing among the most targeted sectors. Manufacturing alone saw about 3.79 million of those. Maharashtra, which has well over 556,000 engineering and manufacturing units, logged the highest count of any state at 36.13 million. Makes sense, in a grim way. More machines, more targets.

Then there's ransomware. Cyble's Q1 2026 report named India the most targeted country in Asia Pacific for ransomware, with 45 incidents in just that quarter. That's up 165 percent from the same quarter a year earlier. IT, manufacturing, healthcare, banking, and automotive all showed up on the list of hit sectors.

Also, it isn't only abstract data. Tata Electronics confirmed a cyber incident in June 2026 and restricted access to critical systems while outside specialists helped with the investigation. A big leak was claimed, though that part wasn't verified at the time of writing. The same roundup mentions that CERT-In handled over 2.9 million incidents in 2025.

One more that bothered me. Kaspersky's Q1 2026 data, as summarized by a threat tracker covering India's factory boom, found manufacturing was the only major industry where attacks on industrial control systems went up. Everyone else dipped or stayed flat. Factories went the wrong way.

Let me strip it down. Cyber risk management is a loop. You figure out what you have, you figure out what could go wrong, you decide which problems are worth fixing first, you fix them, and then you check whether it worked. Then you do it again because your business changed while you weren't looking.

The part people skip is the second step. They jump straight to tools. A firewall here, an antivirus there, maybe a shiny dashboard. But risk is a mix of three things: how likely something is, how bad it would be, and how well you're set up to cope. A tiny gap in a system that runs your whole assembly line matters far more than a big gap in a spreadsheet that holds last year's canteen menu.

This is also where business continuity comes in, and honestly, it's the bit I think gets underrated. Prevention will fail sometimes. It just will. So the real question becomes how fast you can get back on your feet. Do you have backups you've actually tested? Do you know who calls whom at 2 a.m.? Is there a manual fallback for the line, even a clumsy one? A decent risk mitigation and business continuity plancovers assessment, recovery, and compliance together instead of treating them as three separate headaches owned by three separate people who never speak.

Here's what I find funny about industrial IoT in sales decks. Slide one is always the dream: sensors everywhere, predictive maintenance, real-time dashboards, savings. Slide fourteen, maybe, has a small gray box that says "security."

Industrial devices weren't built with the internet in mind. A lot of the machinery running India's plants was designed to sit on an isolated shop-floor network for fifteen or twenty years, doing one job reliably. Then somebody wanted remote monitoring, so it got connected. Nobody rewrote the security because, well, the thing worked fine and nobody wanted to touch it.

That gap is where trouble lives. Old firmware that can't be patched without stopping production. Default passwords that never got changed because changing them once broke something. Flat networks where the office Wi-Fi and the controller for a furnace can, in theory, reach each other.

The government has noticed. The Central Electricity Authority's new cybersecurity rules for the power sector, as discussed in a Quick Heal media piece on critical sectors, require physical separation between IT and operational technology networks, plus incident reporting to CSIRT-Power and CERT-In within six hours. Six hours. Think about your own setup for a second. Could you even confirm an incident in six hours, let alone report it?

I'll be a bit opinionated here. When you're shopping for industrial IoT solutions, don't start with the features that look good in a demo. Start with the boring questions.

Can you see every connected device in one place? You can't protect what you don't know exists, and that sounds obvious until you try it. Can you update or isolate a device remotely without sending a technician three hundred kilometers? Can you tell the difference between a sensor that normally behaves and one that has quietly started sending data somewhere strange?

Delphi Infotech's IoT securityand edge computingframes it in a way I found sensible. They talk about remote device management, where you monitor, update, and troubleshoot connected devices from a central point, with automated alerts so downtime stays short. That's the unglamorous backbone. If you can't manage devices at scale, the cool analytics on top are built on sand.

The second thing is visibility, and I don't only mean security visibility. IoT data visualisation, meaning dashboards that turn messy sensor streams into something a supervisor can read in ten seconds, doubles as a safety net. A pump whose vibration pattern changes is a maintenance clue. It might also be somebody poking around. A good dashboard helps you notice both, which is a nice bonus for something you were buying anyway.

I used to think edge computing was one of those buzzwords that existed purely so consultants had something new to say. Then I understood the actual point.

In a lot of factories, sending every bit of sensor data to a faraway cloud and waiting for an answer is slow, expensive, and sometimes impractical. Connectivity drops. Latency matters when a machine needs to react in milliseconds. So you process data closer to where it's created, on a small device or gateway sitting right there on the floor.

That helps performance, obviously. But it can help security too, which is the part people miss. Less raw data travelling across the open internet means fewer chances to intercept it. Sensitive process data can stay inside your own walls while only the useful summaries go out. And if the internet link goes down, the line can keep running on local logic instead of freezing.

Now, I'll add a caution because I don't want to oversell it. Edge devices are also more computers to look after. Every gateway you drop on a shop floor is one more thing that needs patching, monitoring, and a decent password. Edge computing moves the work around. It doesn't make the work vanish. If your team is already stretched thin, adding fifty edge boxes without a plan to manage them is how you create a brand new problem in the name of solving an old one.

When most people hear "dark web," they picture something out of a thriller. Hooded figures, glowing green text, a guy whispering a password. The reality is way more mundane, and in a weird way, scarier. It's a marketplace. Boring, busy, commercial.

SOCRadar's India Threat Landscape Report 2026 found that 89.9 percent of the dark web threats they observed focused on Indian entities. The activity broke down mostly into selling (about 48.6 percent) and sharing (about 43.85 percent). In plain terms, this is people trading and giving away stolen stuff. Accounts, databases, access to company networks.

The cheapest and most common item on the shelf is credentials. Usernames and passwords. Seqrite's analysis flagged Indian IT firms as facing the highest volume of credential theft attempts, noting that stolen logins often end up circulating on dark web marketplaces where several threat actors can pick them up. A login for a cloud console or a VPN is worth a lot, because it skips the hard part of hacking. Why break a window when somebody's selling you the key?

The usual source is infomercial malware. It sits quietly on an infected device, grabs saved browser passwords and session data, and bundles everything into neat text files. One dataset flagged by HEROIC in July 2026 held 18,941 records of emails, plaintext passwords and the URLs those accounts were used on, all harvested from infected machines. The victims often never get any warning.

Good news first. Dark web protection is far less dramatic than it sounds. At its core, it's monitoring plus a response habit.

The monitoring side means using a service that scans hidden forums, marketplaces, and leak channels for anything tied to your company. Your domain names. Employee email addresses. Leaked credentials. Mentions of your brand in a seller's listing. Delphi's dark web monitoringtools  describes this as tracking hidden forums and marketplaces where stolen data may show up, with alerts so you can act before the damage spreads. Scanners do the searching because no human has time to browse underground forums all day, and honestly nobody should want that job.

But the alert is only half of it. The response habit matters more, and this is where I see people stumble. If a monitor tells you three employee passwords are floating around, what happens next? Ideally, you reset those passwords the same day, kill any active sessions, check whether those accounts had access to anything sensitive, and make sure multi-factor authentication is switched on. If the alert just sits in somebody's inbox for two weeks, you paid for a smoke detector and then removed the batteries.

Seqrite's advice for this problem lines up with common sense. Use zero-trust thinking, enforce multi-factor authentication everywhere you can, and keep watching for credential exposure outside your own network, including on the dark web. Nothing exotic. Just discipline.

I know, I know. Compliance. The least fun word in the English language. But in India right now, it's genuinely worth your attention because the money involved changed.

The Digital Personal Data Protection Rules were notified in November 2025, and full compliance becomes mandatory on 13 May 2027. As of today, early November 2026, that's about six months away. According to a DPDP implementation roadmap from TCSA, failing to maintain reasonable security safeguards that lead to a breach can draw penalties of up to ₹250 crore, while failing to notify about a breach can cost up to ₹200 crore. Those are ceilings, not guaranteed fines, and the Board looks at the specifics of each case. Still, one incident could trigger more than one penalty at the same time. That's the part that should make a finance head wince.

Breach notification is where the practical pain sits. Under the Rules, organisations need to inform the Data Protection Board and affected people, with a more detailed report due within 72 hours. This explainer on DPDP breach notification points out that your detection-to-notification process should be fast enough to produce a usable summary in well under that window, since you also have separate reporting duties to CERT-In.

Here's why that ties back to everything above. You can't report a breach you haven't detected. You can't scope a breach if you don't know what devices or accounts were touched. And you can't claim "reasonable safeguards" if you never looked at your risks in the first place. Cyber risk management, device visibility, and dark web monitoring turn out to be the exact muscles the law is asking you to build. Funny how that works.

Okay, enough worry. Here's how I'd actually begin if I were handed this problem tomorrow, in roughly this order.

Start with a list. Every device, every system, every vendor with access. It'll be messy and incomplete. That's fine. An incomplete list beats no list.

Then rank things by how much it would hurt if they stopped or leaked. Your production controllers and customer database go near the top. The canteen menu does not.

Fix the cheap stuff next. Multi-factor authentication on email, VPN and admin accounts. Change default passwords. Patch what can be patched. Separate the office network from the shop floor if it isn't already. None of this needs a giant budget, just a few focused weeks.

After that, switch on monitoring. Network visibility for your connected devices, and dark web monitoring for your domains and people. Decide, in writing, who receives each alert and what they do within the first hour.

Write a short incident plan. One or two pages, not a forty-page binder nobody opens. Who's in charge, who gets called, how you reach regulators, what the manual fallback is for the line. Then rehearse it once with the actual people. A small tabletop exercise, even over chai, shows you the holes faster than any audit.

Finally, put a reminder in the calendar to do it all again in six months. Your business will have changed. New machines, new vendors, new people. Risk management that doesn't repeat is just a one-time cleanup.

• India logged around 265.5 million threat detections in a year, and manufacturing is among the most targeted sectors, so factories should plan as if they're on the list.

• Cyber risk management is a repeating loop of finding assets, ranking risks, fixing priorities, and checking results, not a single purchase.

• Industrial IoT solutions need device visibility, remote management, and network segmentation before fancy analytics.

• Edge computing can improve speed and reduce data exposure, but every edge device is one more thing to patch and monitor.

• Dark web protection works best as monitoring plus a fast response, such as same-day password resets and multi-factor authentication.

• DPDP penalties can reach ₹250 crore, with full compliance due 13 May 2027, so detection and breach reporting need to be ready well before then.

Q: What is cyber risk management in simple words?

A: It's the ongoing process of finding what you need to protect, working out what could go wrong, fixing the most serious gaps first, and regularly checking that the fixes still hold. It also covers how fast you can recover if something fails anyway.

Q: Why are industrial IoT devices harder to secure than normal computers?

A: Many were built to run for years on isolated networks and were never designed with internet threats in mind. They can be difficult to patch without stopping production, and default passwords or flat networks often stay in place. That's why visibility and segmentation matter so much.

Q: What does dark web protection actually do?

A: It scans hidden forums, marketplaces, and leak channels for your company's data, such as employee credentials, domains, or customer records, and alerts you when something turns up. The value comes from acting quickly on those alerts, for example by resetting passwords and ending active sessions.

Q: Is my small business really a target?

A: Attackers often go after whoever is easiest to reach, and automated tools don't check company size first. Smaller firms also work as stepping stones into bigger partners through shared logins and supply chains, so size alone doesn't keep you safe.

Q: When do the DPDP penalties start applying in full?

A: The substantive obligations and penalty framework become fully enforceable on 13 May 2027, based on the phased timeline in the DPDP Rules 2025. Maximum penalties can reach ₹250 crore for failing to maintain reasonable security safeguards. Check the current position with a qualified legal adviser since details can be clarified over time.

Q: Where should a business with a limited budget start?