Key Takeaways
- India’s digital ecosystem now exceeds one billion internet users, rests on Aadhaar, UPI and 5G, creating a vast but vulnerable attack surface.
- In 2025 the country faced >265 million cyber‑attack attempts and ≈369 million malware detections, with CERT‑In logging nearly 29.44 lakh incidents.
- Cyber threats are increasingly intertwined with geopolitical rivalry; attacks accompany military actions such as Operation Sindoor.
- Malware (especially trojans and file infectors) remains the dominant tool, averaging ~702 detections per minute.
- Education, health, manufacturing and government sectors endure 1,000–2,000 weekly attacks; risk has spread from metro hubs to smaller towns.
- State‑sponsored groups like APT36 (Transparent Tribe) and SideCopy use sophisticated RATs to target defence and aerospace entities.
- Critical infrastructure—power grids, telecoms, transport and govt platforms—is a prime target because disruption yields cascading economic and security effects.
- Government bodies saw a 138 % rise in attacks between 2019‑2023, a trend persisting into 2025, with many advanced threats traced to actors linked to China and Pakistan.
- The Digital Personal Data Protection (DPDP) Act, 2023 is a milestone but suffers from exemptions, compliance uncertainty, weak enforcement and limited SME readiness.
- The Cyber Shikshit Bharat report recommends: nationwide cyber‑awareness from school level; a >1 million‑strong cybersecurity workforce; Cyber Security & AI Centres of Excellence; annual risk audits; Zero‑Trust adoption; indigenous tech investment; and a National Cyber Crisis Management Framework.
- Success hinges on four pillars: stronger legislation, secured infrastructure, skilled manpower, and collaborative governance among government, industry, academia and citizens.
- Embedding cyber resilience into India’s Viksit Bharat 2047 vision is essential to safeguard economic growth, institutional credibility and strategic autonomy in an increasingly contested digital world.
India’s Digital Expansion and Its Risks
India’s digital transformation has become a hallmark of its economic rise, boasting more than one billion internet users, the world’s largest digital identity system (Aadhaar), rapid UPI adoption, and nationwide 5G rollout. These advances have forged an unprecedented digital public infrastructure that underpins government services, finance, health, education and logistics. While delivering efficiency and inclusion, the interconnectedness also expands the attack surface, turning every new digital service, cloud platform or connected device into a potential entry point for adversaries.
Scale of Cyber Threats in 2025
The Lisianthus Tech “Cyber Shikshit Bharat: Building a Cyber‑Resilient India” report reveals staggering numbers for 2025: over 265 million cyber‑attack attempts were recorded, and security systems detected nearly 369 million malware instances across 8.44 million endpoints. CERT‑In alone handled approximately 29.44 lakh incidents, underscoring the sheer volume of malicious activity confronting the nation’s digital ecosystem.
Cybersecurity as a National Security Imperative
These figures reflect a broader global pattern where cyber warfare, espionage and crime are inseparable from economic competition and geopolitical rivalry. Consequently, the report argues that cybersecurity must transcend its traditional IT‑centric role and be recognised as a pillar of national security and economic resilience. Protecting digital assets is now as vital as safeguarding physical borders.
Evolution of the Cyber Shikshit Bharat Initiative
Originally an awareness‑driven programme, Cyber Shikshit Bharat has matured into a comprehensive strategy that couples cyber literacy with skills development, critical‑infrastructure protection and indigenous innovation. The initiative now seeks to build a proactive defence posture rather than merely reacting to incidents.
Malware Trends and Attack Frequency
Malware remains the workhorse of attackers, with the reported 369 million detections translating to roughly 702 malicious alerts every minute. Trojans and file infectors accounted for nearly 70 % of observed threats, while adversaries continually refine evasion techniques to bypass legacy security controls. Indian organisations faced between 1,000 and 2,000 cyberattacks each week, highlighting the relentless pressure on defenders.
Sector‑Specific Targeting and Geographic Spread
Education, healthcare, manufacturing and government sectors experienced the highest targeting intensity. Although metro states such as Maharashtra, Gujarat, Delhi and Tamil Nadu remain hotspots, expanding digitisation has exposed smaller cities and towns to rising cyber risk, demonstrating that no region is immune.
Cyber Operations in Geopolitical Conflicts (Operation Sindoor)
The report treats cyber activity as an integral facet of modern warfare. During Operation Sindoor, roughly 1.5 million cyber‑attack attempts were logged, comprising DDoS floods, phishing campaigns, malware deployment, website disruptions and influence operations. About 150 of these attempts resulted in successful compromises. Critical infrastructure was heavily targeted—around 200,000 intrusion attempts hit the power sector, telecom networks (including BSNL) endured continuous assaults, and the President’s official website suffered prolonged DDoS activity.
State‑Sponsored Espionage and APT Activity
Advanced persistent threat groups such as APT36 (Transparent Tribe) and SideCopy were implicated in remote‑access‑trojan campaigns using Geta RAT and Ares RAT against defence, aerospace and government entities. These operations illustrate the growing convergence between cyber espionage and geopolitical competition, where information theft and influence operations complement conventional military tactics.
Critical Infrastructure Under Siege
Power grids, telecom networks, transport systems and government digital platforms are prime targets because their disruption can trigger cascading economic and national‑security consequences. The report stresses that safeguarding these assets requires dedicated operational‑technology (OT) security measures alongside traditional IT protections.
Government Attack Trends and Foreign Threat Attribution
Government entities witnessed a 138 % increase in cyberattacks between 2019 and 2023, a trend that persisted into 2025. Threat intelligence suggests a significant share of advanced threats originates from actors linked to China and Pakistan, reinforcing the need for vigilant attribution and resilient defences against state‑sponsored campaigns.
Challenges with the DPDP Act, 2023
While the Digital Personal Data Protection Act, 2023 marks an important legislative milestone, the report notes several implementation hurdles: overly broad government exemptions, ambiguous compliance requirements, concerns over the Data Protection Board’s institutional independence, unclear cross‑border data‑transfer mechanisms, and limited enforcement capacity. Medium‑sized enterprises and startups continue to struggle with practical compliance, and the law’s phased rollout creates uncertainty for organisations shaping their data‑governance frameworks.
Recommendations for Building Cyber Resilience
To counter the evolving threat landscape, the report proposes a multi‑pronged roadmap: launch nationwide cyber‑awareness campaigns beginning at school level; expand the cybersecurity workforce to exceed one million professionals; establish Cyber Security and Artificial Intelligence Centres of Excellence; conduct annual cyber‑risk audits; mandate Zero‑Trust security architectures; increase investment in indigenous cybersecurity technologies; and create a National Cyber Crisis Management Framework capable of coordinating responses during large‑scale cyber emergencies.
Workforce Development and Indigenous Innovation
A skilled cybersecurity talent pool is deemed a strategic national capability. As India aspires to lead the global digital economy, demand for experts will surge across banking, health, manufacturing, telecoms and defence. Investing in education, certifications and continuous upskilling will transform cybersecurity from a job market niche into a cornerstone of national resilience.
Collaborative Governance and the Four‑Pillar Strategy
The report underscores that technology alone cannot secure cyberspace. Success depends on awareness, governance, organisational culture and coordinated response mechanisms. It identifies four foundational pillars for India’s future cyber strategy: strengthening legislation, securing critical infrastructure, building a skilled workforce, and fostering institutional cooperation among government, industry, academia and citizens.
Future Outlook: Aligning Cyber Security with Viksit Bharat 2047
Looking ahead, India’s digital ambitions—AI, cloud computing, digital payments, smart manufacturing and connected infrastructure—will deepen economic integration but also amplify cyber risk. The Cyber Shikshit Bharat report contends that achieving the Viksit Bharat 2047 vision requires cybersecurity to be woven into national development planning, not treated as an afterthought. A resilient cyber posture will determine the security of digital infrastructure, the robustness of the economy, the credibility of institutions and India’s ability to exercise strategic autonomy in an increasingly contested digital world.