India’s digital public infrastructure (DPI) now operates at a scale most of the world has never had to defend. UPI processes well over 15 billion transactions a month. Aadhaar sits underneath identity verification across the banking & the telecom industry. The Account Aggregator framework is now moving sensitive financial data between institutions in real time. This is precisely the kind of high velocity, high trust digital rail that India’s startup and policy ecosystem has spent over a decade building.
Infrastructure of this scale makes it an ideal target. Every API that enables interoperability is also a potential attack surface. Every dataset that powers personalisation is also a dataset someone wants to steal. With the Digital Personal Data Protection (DPDP) Act, 2023 now moving toward enforcement, and CERT-In’s six-hour breach reporting mandate already in force, security has stopped being an IT department’s side project and is now a board level liability and closing that gap is exactly the job a Chief Information Security Officer (CISO) is built to do.
What does a CISO actually do?
Most Indian boards, particularly in mid sized banks, NBFCs, and growth stage startups understand revenue, growth, and compliance checkboxes far better than they understand threat models or zero day vulnerabilities. A CISO sits at the intersection of these worlds by:
- Translating Regulation into Engineering Priorities: Reading RBI’s cybersecurity frameworks, SEBI’s CSCRF guidelines, and sector specific mandates, and converting them into concrete technical work.
- Translating Technical Risk into Business Language: Making risk actionable for a CEO, CFO, or investor without requiring a glossary.
- Acting as Connective Tissue: Linking a company’s security posture to its business strategy, rather than functioning as a compliance role.
How AI Will Redefine the CISO’s Role?
By 2030, artificial intelligence will be deeply embedded in virtually every business process at every significant Indian enterprise. Supply chain optimization, customer service, financial risk management, human resources, marketing, product development and strategic planning will all involve AI systems making consequential decisions either autonomously or under the influence of humans.
This creates a security and governance challenge that goes far beyond today’s concerns about AI enabled phishing or data leakage through LLM APIs. The CISO of 2030 will need to address the security of the entire AI lifecycle:
- Training Data Integrity: Adversarial data poisoning during training can introduce vulnerabilities that are almost impossible to detect once a model is deployed.
- Model and Infrastructure Security: Protecting model weights and inference infrastructure from compromise.
- Adversarial Robustness: Ensuring AI systems hold up against adversarial inputs at inference time.
- Governance and Monitoring: Building processes that catch unexpected AI behaviour before it causes harm.
A new function is likely to emerge alongside these responsibilities: AI Security Operations, a parallel to the traditional SOC but focused specifically on monitoring deployed AI systems for signs of compromise, manipulation, or unexpected drift. By 2030, this will likely be a standard part of the enterprise security organisation.
The Regulatory Landscape Ahead
India’s National AI Portal and the proposed AI Governance Framework being developed by MeitY will create regulatory expectations around AI security that the CISO will be responsible for meeting. The CISO of 2030 will also need to navigate the relationship between AI security and data privacy under the evolving DPDP Act framework. As the Act’s rules are progressively notified and enforcement begins, the interaction between AI model training on personal data, the data protection obligations of data fiduciaries, and the security requirements for AI systems processing sensitive personal information will create a complex compliance landscape, the one that requires close coordination between the CISO and other departments within the firm.
Where Do We Start?
The implication for India’s CXO community is direct, the CISO of 2030 cannot be hired in 2029. The leaders who will occupy those roles need to begin building the requisite capabilities now via deliberate exposure to emerging threat domains, cross-functional experience in AI governance, data privacy and supply chain management, and the kind of board level relationship building that comes only from years of operating at the highest levels of enterprise risk governance.
It is clear, that organizations need to invest in their CISO’s development today by giving them the budget, authority, board access and professional development support to grow as the demands of 2030 will be significantly more resilient, competitive and trusted than those that treat the CISO as a technical hire to be managed at arm’s length.
India’s digital future holds extraordinary opportunities. Whether that future is realised securely will heavily depend on the quality of the security leaders India develops between now and 2030.
Interested in more? Visit our website
Please note: This blog is authored by our volunteers, Girish Elchuri, Rinka Singh & Shantanu Kohli.