As artificial intelligence moves from experimentation to deployment across enterprise systems, cybersecurity leaders are calling on organisations to reassess their security practices, strengthen governance and prepare for risks arising from increasingly autonomous AI systems. With AI agents gaining access to business applications, data and customer-facing processes, industry leaders say security must extend beyond detecting external threats to include access management, accountability, data protection and recovery readiness.
Balaji Rao, Area Vice President, India and SAARC, Commvault, highlighted three common assumptions that Indian enterprises need to rethink as AI adoption accelerates. Citing CERT-In data showing over 29.44 lakh cyber incidents in India in 2025, he said organisations must reconsider how they manage risk when AI systems can act autonomously.
“India’s AI ambitions are accelerating, but so is the complexity of securing an increasingly digital economy. As enterprises deploy AI agents across business systems, traditional security assumptions are being tested. With CERT-In reporting over 29.44 lakh cyber incidents in India in 2025, organizations must rethink not just how they prevent attacks, but how they manage risk when AI acts at machine speed.”
Rao identified three myths that could leave organisations exposed: that AI risk begins and ends with malicious actors, that detecting threats means an organisation is in control, and that restoring data automatically ensures recovery. On the risks associated with AI agents, he said: “AI agents can access sensitive data, operate with delegated identities and take actions autonomously. Excessive permissions, unmanaged access and unintended actions can create exposure even without an external attacker. Enterprises must know what their AI can access, what it can change and where risks are emerging.”
He also cautioned that threat detection alone does not guarantee security, as threats may remain hidden in protected data and compromised identities may allow attackers to retain access. Similarly, restoring data may not ensure safe operations unless organisations identify clean recovery points, re-establish trusted identities and restore critical applications in the correct order. Rao said enterprises must move from assuming they are protected to demonstrating that they are prepared, adding that security in the age of AI is also about keeping business operations running when preventive measures fail.
Governance must evolve with agentic AI
Raja Lakshmipathy, Vice President and Managing Director – India & SAARC, Genesys, said security, privacy and governance must remain central as organisations move towards deploying agentic AI across customer experiences. “As Indian organisations move from AI experimentation to deploying agentic AI across customer experiences, security, privacy and governance will need to remain central to that journey and need to evolve alongside it. AI agents are increasingly able to reason, taking on more complex tasks and interacting with enterprise systems, making it important to establish clear boundaries around access, decision-making and accountability. This is where agentic orchestration can play an important role – to bring AI, people, data and systems together as part of a connected customer experience. To do so, the focus needs to be on creating a human and AI partnership where technology can act with the right context, while humans continue to guide, supervise and step in when their judgement or expertise is required. This requires clear permissions for technology teams, appropriate guardrails and a shared understanding across the organisation of how AI should be used. With AI capabilities developing rapidly, governance should not be a one-time exercise. Security and governance practices will need to be continually reviewed as organisations expand their use cases. Cybersecurity Awareness Month provides an opportunity to reinforce the importance of these measures and a timely reminder that responsible AI innovation and customer trust need to go hand in hand”. His remarks highlight the need for organisations to review their security and governance practices as AI capabilities evolve, rather than treating oversight as a one-time exercise.
People remain central to cybersecurity
Priti Sawant, CEO and Founder, JoulestoWatts, stressed that cybersecurity also depends on the everyday decisions employees make while handling files, responding to requests and using AI tools. “As organisations become more AI-driven, the question is no longer simply how to protect the systems they use. It is how to help people make safer decisions at the speed those systems now operate. AI can help organisations spot vulnerabilities, but it can also make deception more convincing and threats harder to recognise. That means security must be built into the ordinary moments of work: the file someone shares, the request they choose to question and the data they trust a tool to handle. Technology can raise the alarm; people still need to know when to pause.
As India’s data protection framework sharpens expectations around personal information, privacy and security must move from policy documents into daily practice. Clear accountability, sound governance and thoughtful use of data need to work together across the organisation. Cybersecurity is not a wall around the business; it is a habit shared across it. The strongest defence may be a person who notices that something feels unusual and feels empowered to speak up before a small lapse becomes a breach.” Sawant’s comments point to the importance of translating security policies into everyday practices, supported by clear accountability and an organisational culture in which employees feel empowered to question suspicious activity.
AI security requires shared ownership
Abdullah Zubair, VP – Technology, BCE Global Tech, said organisations must look beyond external attackers and examine the risks created by the way AI systems are designed, connected and given permissions. “Most conversations about AI security still start with the attacker. In my experience, the bigger exposure is usually something we built ourselves. Think of an AI agent with access to data it doesn’t need, a connection into a critical application without proper controls, or the freedom to act without anyone signing off. None of that needs a sophisticated attacker to go wrong. It’s a vulnerability we’ve designed.
This matters more now because AI is moving out of pilots and into the processes that run the business. Before any agent goes live, security leaders should be able to answer three questions: what can it reach, what can it do, and where does a human have to say yes? Those answers can’t be a one-time sign-off. Agents pick up new tools, data, and permissions over time, so the controls need to be checked just as often. Ownership is the other shift. AI risk doesn’t belong to the security team alone. Technology, security, and business leaders must agree on the boundaries before deployment, not after an incident forces the conversation. At BCE Global Tech, that’s our starting point for the critical networks we support, understand what’s connected before adding another layer of defense.”
Zubair emphasised that AI risk management requires collaboration between technology, security and business leaders, with clear boundaries established before deployment and controls reviewed as agents acquire new tools, data and permissions. The industry perspectives point to a broader shift in enterprise cybersecurity priorities as AI adoption expands. Alongside conventional threat prevention, organisations need to examine how AI systems access and use data, maintain human oversight, embed privacy into daily operations and ensure that recovery processes can restore trusted business operations.
