Indian companies seek on-site security engineers as AI-led cyber threats mount

Summary

On 4 November, the Indian Cybercrime Coordination Centre (I4C), under the Union home ministry, cautioned banks and fintech companies about financially motivated cyberattacks that use AI agents to compromise systems at machine speed.

New Delhi: As cyberattacks become increasingly sophisticated and enterprises step up their adoption of artificial intelligence (AI), Indian companies are strengthening their digital defences by seeking a greater on-ground presence of security professionals.

Moving beyond remote monitoring and support, businesses are asking cybersecurity startups to station their experts at their offices to identify threats, assess vulnerabilities and respond to breaches swiftly, without having to wait for an external team to intervene.

The move to ramp up vigilance comes at a time when there has been an increase in cybersecurity incidents in the country. In October, India's cybersecurity agency CERT-In disclosed that AI agents being tested by technology providers had exceeded their authorised tasks and accessed confidential records in the live systems of Indian companies. On 4 November, the Indian Cybercrime Coordination Centre (I4C), under the Union home ministry, cautioned banks and fintech companies about financially motivated cyberattacks that use AI agents to compromise systems at machine speed.

I4C's warning came months after Anthropic and OpenAI disclosed that their AI models had independently breached the systems of other organisations during cybersecurity tests, highlighting the growing ability of autonomous AI agents to exploit vulnerabilities.

Amid these concerns, cybersecurity startups are seeing growing demand for forward-deployed security engineers - specialists who work on-site alongside a company's internal IT, engineering and security teams. Their responsibilities extend beyond monitoring systems to identifying vulnerabilities, understanding an organisation's technology infrastructure and implementing security measures. Mint spoke with at least five founders and analysts to understand the factors driving this emerging demand.

"Enterprises have started to understand that remote monitoring and managed security services may not offer them the needed context and understanding of the issues that need to be addressed by enterprises," said Abhishek Tripathi, co-founder and chief of innovation at cybersecurity startup Deep Algorithms.

The growing adoption of AI is also creating new security challenges for companies. Unlike chatbots that primarily respond to questions, AI agents can independently perform tasks. For instance, an AI agent handling customer complaints could read emails, access customer records and process refunds. However, if these agents are given excessive access or are manipulated through malicious instructions, they could expose sensitive company data or carry out unauthorized actions.

"Forward-deployed security engineers are becoming the bridge between AI ambition and production reality. Their role is not simply to find vulnerabilities, but to ensure that agents deliver value without acquiring uncontrolled authority," said Niyati Daftary, principal analyst at research and advisory firm Gartner.

The growing use of AI is further transforming how enterprises approach security, with companies increasingly looking to integrate safeguards during the development process rather than conduct security checks only after a product is built.

"The next phase of enterprise AI won't be defined by how many agents organisations deploy, but whether they can see, control and answer for them," said Sundareshwar Krishnamurthy, partner and India cyber leader at consulting firm PwC India. He added that security professionals need to work alongside internal engineering, IT and data teams to continuously design and refine controls.

Despite the growing demand for security specialists, salaries have not seen a commensurate increase across the board. Experts point to the limited availability of experienced cybersecurity professionals in India, prompting companies to train freshers and give them hands-on experience to bridge the talent gap. As a result, many founders are recruiting freshers and training them from scratch to take on forward-deployed security engineering roles.

Monthly salaries for deployed engineers range from ₹18,000-19,000 for freshers to ₹4-5 lakh for senior professionals. Those earning at the higher end typically have over 10-12 years of experience and specialise in security operations or advise companies on cybersecurity strategy as virtual chief information security officers (CISOs).

The Data Security Council of India (DSCI) and US-based SANS Institute, in their Indian Cyber Security Skilling Landscape Report 2025-26, published on 1 May 2026, found that 73% of local businesses reported limited availability of skilled candidates.

Cybersecurity startup founders, meanwhile, say on-site deployment of security engineers creates significant opportunities for their businesses.

"Our contractual obligations and deal sizes have increased, and clients are giving us more business because our employees work from their offices. This gives us a better understanding of their internal requirements and upcoming needs, allowing us to customize our pitches and offer more products and services," said Mohit Anand, co-founder and chief executive officer (CEO) of cybersecurity startup Mitigata, an AI-native cyber resilience and cyber insurance startup. He cited the example of an IT professional initially deployed at a client organisation. What began as a single deployment eventually expanded into a larger engagement involving multiple products, compliance services and security solutions.

Meanwhile, as the number of cybersecurity attacks increases, the demand for cybersecurity professionals is also expanding beyond traditionally high-spending sectors such as banking, financial services and insurance (BFSI), government and critical infrastructure. These sectors have historically prioritised cybersecurity because of regulatory requirements, sensitive data and the potential consequences of security breaches.

"However, cybersecurity requirements are increasingly expanding into manufacturing, healthcare, IT/ITES, digital-first businesses and mid-market enterprises. Manufacturing organisations, for instance, are increasingly focusing on securing interconnected IT and operational technology environments, while startups and mid-sized businesses are recognising the need to protect cloud infrastructure, applications and customer data as they scale," said Satyam Gupta, business head - cybersecurity at digital forensics and cybersecurity company Pelorus Technologies.

Gupta, however, added that not every company needs a full-time security engineer physically present at its office. Many are also looking at hybrid models that combine remote security monitoring with a dedicated on-site engineering support.