As artificial intelligence (AI) becomes increasingly embedded in enterprise systems, India’s major IT services firms are widening their cybersecurity defences to cover not just employees and devices but also AI applications, APIs and agents.
The move comes amid a series of data breaches at TCS, HCLTech, Cognizant and Hexaware Technologies disclosed in August, highlighting the vulnerabilities that remain even as companies strengthen their security posture.
The shift is centred around Zero Trust, a security model under which no user, application or device is trusted by default and access is continuously verified. With employees using AI-powered applications and services becoming increasingly connected to enterprise data, companies are now having to extend the same principle to AI systems.
“At Infosys, our approach to cybersecurity is anchored in security for AI and Zero Trust,” said Umashankar Lakshmipathy, EVP and co-head of cloud, infrastructure and security services, cybersecurity and Cobalt at Infosys. The company is strengthening its defences against AI-enabled threats and working with cybersecurity firms including CrowdStrike, Palo Alto Networks, Zscaler and Microsoft.
Infosys is also focusing on employee training through its LEX learning platform and cyber labs. Mphasis, meanwhile, is combining Zero Trust with continuous threat monitoring, proactive threat hunting and AI-assisted detection, while also strengthening AI governance, access controls and data protection, Ravi Vasantraj, global delivery head at the company, told Fe.
The challenge, however, is not restricted to hackers breaking into corporate systems. AI tools themselves can become a route through which sensitive information leaves an organisation, sometimes without any malicious intent.
Accidental Data Leaks
“Most AI-related data leaks are not very sophisticated attacks. They are accidental: an engineer pastes source code into a free chatbot, a team feeds customer contracts into an unvetted summarisation tool,” Debashis Singh, chief information officer at Persistent Systems, said.
Persistent has put in place AI data governance policies that classify information such as personally identifiable information, source code, financial data and intellectual property, and specify what can be processed by AI systems. Access is governed through identity- and role-based controls, while the company conducts AI-specific red teaming to test for prompt injection, data leakage, model manipulation and unauthorised retrieval.
The recent breaches have also highlighted the importance of controlling access to cloud environments. Last month, a hacker claiming responsibility for the incidents said sensitive employee information had been obtained through a Microsoft Azure tenant login using compromised credentials.
Expanding the Security Perimeter
Cybersecurity experts believe Zero Trust remains central to protecting enterprises, but the model itself needs to evolve as AI becomes more deeply integrated into corporate systems.
“It is critical to have Zero Trust now but the model must also evolve as AI does. All prompts, training data used to train your large language model and the external model outputs are potential risks in the environment,” said Daryl Pereira, director and head of the office of the chief information security officer for Asia-Pacific at Google Cloud.
Companies will also need a scanning layer between external AI models and internal IT systems to identify potentially malicious data, while API rate limiting can help contain brute-force attacks, he said.
“The Zero Trust architecture is still valid, but we need to shift our mindset from just user IDs and expand the perimeter to include AI agents as well,” Pereira said.