Security

Indian SMEs step up cybersecurity investments as threats evolve

A new TTBS-CMR study finds 84% of Indian SMEs plan to increase cybersecurity spending over the next 12–24 months, while gaps in continuous monitoring, expertise and fragmented security tools continue to challenge overall cyber resilience.

Indian small and medium enterprises (SMEs) are placing greater emphasis on cybersecurity as evolving digital threats raise concerns around business continuity, customer trust and operational resilience. According to the latest SME Digital Insights 2026: Cybersecurity study by Tata Tele Business Services (TTBS) and CyberMedia Research (CMR), 84% of SMEs plan to increase their cybersecurity investments over the next 12–24 months.

The findings indicate a growing shift in how SMEs view cybersecurity, with protection increasingly being considered a strategic business priority rather than solely an IT function. However, the study also points to a gap between investment intent and cybersecurity preparedness, with many organisations continuing to rely on reactive approaches.

Investment Intent Grows, But Readiness Remains Uneven

The study found that 40% of SMEs had experienced a cyber incident during the past two years, but only 28% implemented structural cybersecurity improvements following an incident. Meanwhile, 60% responded through tactical upgrades to security tools, indicating that incident response often remains focused on immediate remediation rather than strengthening the broader security posture.

Continuous monitoring also remains limited. Only 12% of SMEs said they continuously monitor their cybersecurity environments, while nearly 35% operate multiple cybersecurity tools but have limited visibility into their overall risk exposure. Fragmented security deployments, limited monitoring capabilities and a shortage of skilled professionals continue to affect cybersecurity maturity.

“Indian SMEs are entering a new phase of digital maturity, with cybersecurity becoming a key priority for business resilience, customer trust and sustainable growth,” said Vishal Rally, Chief Revenue Officer, Tata Teleservices. “It is encouraging to see that 84% of SMEs plan to increase their cybersecurity investments over the next two years. As cyber threats continue to evolve, businesses need to make cybersecurity an integral part of their broader digital transformation journey, rather than treat it as a standalone initiative.

At the same time, there is a clear capability gap, with 45% of SMEs identifying a lack of cybersecurity expertise as their biggest challenge in implementing effective security measures. This is where trusted technology partners can make a meaningful difference by simplifying cybersecurity, addressing capability gaps and providing integrated, continuously managed solutions that can adapt to emerging threats. At TTBS, our focus is to make enterprise-grade cybersecurity more accessible, scalable and easier to adopt, so SMEs can strengthen their cyber resilience with confidence while continuing to grow and accelerate their digital transformation.”

Expertise and Integrated Security Emerge as Priorities

The study highlights the importance SMEs place on specialist cybersecurity partnerships as they seek to address capability and technology gaps. Ease of integration and quality customer support emerged as key considerations for 48% of SMEs when evaluating cybersecurity partners. Trust and long-term relationships were prioritised by 46%, while 45% placed importance on strong security and compliance capabilities.

The findings also point to significant room for higher cybersecurity spending. While 46% of SMEs allocate less than 5% of their IT budgets to cybersecurity, higher allocations among very-high-intent SMEs indicate a stronger relationship between investment intent and established security foundations.

This suggests that future spending could increasingly focus on strengthening existing cybersecurity frameworks rather than addressing security gaps only after incidents occur.

According to Prabhu Ram, Vice President - Industry Research Group (IRG), CyberMedia Research (CMR), “Our study findings highlight a clear inflection point in the cybersecurity journey of Indian SMEs. While investment intent is rising sharply, cyber maturity remains uneven, with just 12% of SMEs continuously monitoring their cybersecurity environments. Many are still relying on fragmented security deployments, periodic reviews, and reactive remediation, even as the threat environment becomes more persistent and sophisticated. This gap between intent and preparedness is the defining challenge for Indian SMEs today. At CyberMedia Research (CMR), our analysis suggests that SME cyber resilience will increasingly depend on integrated, continuously managed approaches — a shift already visible among the more mature enterprises in our sample."

AI Gains Ground in SME Cybersecurity

Artificial intelligence is also emerging as an important element in the cybersecurity strategies of Indian SMEs. The study found that 35% of SMEs recognise AI as a cybersecurity enabler that can support intelligent threat detection, automate routine monitoring and strengthen cyber resilience.

At the same time, 34% of SMEs expect AI-powered cyber threats to have a material impact on their businesses over the next 12–24 months. The findings point to a growing need for organisations to consider AI not only as a source of new cyber risks but also as a tool that can strengthen their ability to detect and respond to threats.

The study indicates that SMEs are entering a phase where higher cybersecurity investment will need to be accompanied by stronger expertise, integrated security capabilities and continuous monitoring. For businesses navigating an increasingly digital environment, these elements are becoming closely linked to their ability to maintain resilience and sustain growth.

Key Findings

· 84% of SMEs plan to increase cybersecurity investments over the next 12–24 months.

· 89% of medium-sized enterprises plan to increase cybersecurity investments.

· 46% of SMEs allocate less than 5% of their IT budgets to cybersecurity.

· 40% experienced a cyber incident during the last 24 months.

· Only 28% implemented structural cybersecurity improvements after an incident.

· 60% responded with tactical security-tool upgrades.

· 35% operate multiple cybersecurity tools with limited visibility into risks.

· 45% identify a lack of cybersecurity expertise as their biggest implementation challenge.

· 48% value ease of integration and quality customer support when evaluating cybersecurity partners.

· 46% prioritise trust and long-term relationships.

· 45% value strong security and compliance capabilities.