For years, October’s awareness drives had one target: the employee who clicks the wrong link. The voices coming out of this year’s Cybersecurity Awareness Month in India suggest the audience has changed. The weak points security leaders point to now include AI agents with system access, machines that act on unverified instructions, and loan applicants who are not real. For Indian CIOs, the awareness question is moving from “do our staff know?” to “do we know what is acting inside our systems?”

In India, the month is anchored by the Data Security Council of India’s “Be Cyber Street Smart” campaign, launched at the BSE in early October with partners including CERT-In, I4C and MeitY. It targets citizen-level habits such as app safety, payments and scams like malicious APKs, voice-cloning and “digital arrest” fraud. The industry executives who shared comments for the month were focused on the enterprise side of the same problem. All of them are vendors, so their figures and framing are theirs, but the pattern across them is worth a CIO’s attention.

1. AI agents are the new insiders

Ganesh Narasimhadevara, Director Solutions Consulting, India, at New Relic, says AI agents are “fast becoming working employees in many Indian enterprises”, pulling data from KYC workflows, triggering UPI-linked transactions and touching production systems. Hygiene now means knowing “which systems an AI agent can reach, what data it can access, when it takes an action and where human approval is necessary”.

He cites a gap: 93% of organisations are adopting AI agents, but 24.6% run them unmonitored. “An agent operating without oversight becomes an open door,” he says. The company adds that, according to its 2026 Observability Forecast, organisations monitoring AI agents in production are twice as likely to report a 3x or greater return on their observability investments than those that do not. New Relic sells observability tools, so the pitch is built into the argument.

2. Attackers have the same tools

Rajnish Gupta, MD and Country Manager at Tenable India, says machines were behind most cyber incidents this year, and that AI “has lowered the skills and costs required to run a sophisticated attack”. He cites 348,607 incidents in India’s financial sector and 18,855 in healthcare in the first half of the year. The source of those figures was not given, and I could not trace them independently. He asks whether defence spending is “going to the right place”.

3. Fraud is arriving at the front door

Kedar Kulkarni, Co-founder and CEO of HyperVerge, says that in a 30-day study nearly 0.4% of new applications received by banking, financial services and insurance (BFSI) organisations were deepfakes, and for a few organisations the figure reached 1%. His prescription is to run AI checks at onboarding, such as whether the video is from a real camera and whether the face has applied before under another name. He would repeat the checks at account changes and high-value transactions, and send flagged cases to a human reviewer “with the reason attached, so genuine customers don’t pay for a fraudster’s tricks”. HyperVerge sells identity verification, and the study’s sample was not described.

4. When machines are the target, the data is the weapon

Srinivas Shekar, Co-Founder and CEO of Pantherun Technologies, makes the case beyond IT. “A drone can be brought down without firing a single shot. A railway signalling system can be disrupted without anyone physically accessing the tracks. An industrial robot can be made to execute the wrong instruction,” he says, adding that in each case “the attacker may never need to touch the equipment.”

His point is that “a machine may be functioning exactly as designed, but its reliability also depends on the authenticity and integrity of the information it receives.” India installed almost 10,500 industrial robots in 2025, up 15% from 2024, according to the International Federation of Robotics, which ranks the country sixth globally. “Encryption, authentication and data integrity must be considered from the design stage, particularly in environments where machines respond to instructions in real time,” Shekar says.

5. Humans still decide

Priyadarshi Pany, Chairman-cum-Managing Director and CEO of CSM Technologies, takes a balanced view. “Recent incidents of customer data exposure at several organisations remind us that digital trust, once compromised, is difficult to rebuild,” he says. He argues that “AI enables faster threat detection and analysis, human judgement remains essential to making informed decisions and responding effectively to evolving risks.”

The awareness gap after October

One practitioner is blunt about the calendar itself. Puneet Magan, Senior Director, Information Security, Cloud & Infrastructure Services, says he has mixed feelings about awareness months if they become a checkbox of campaigns, emails and a phishing simulation. “Cybersecurity awareness can’t be seasonal. It needs to be continuous!” he says. “The real work happens the other 11 months.”