Deloitte India's Munjal Kamdar explains how cybercriminals exploit third-party vendors to access large organisations, why continuous security monitoring is critical and how businesses can protect their most valuable data. He also outlines practical steps individuals can take to guard against phishin... Recent cybersecurity scares, including critical vulnerabilities in PHP, compromised digital certificate keys linked to eMudhra and a suspected data exposure involving State Bank of India, have raised concerns about the security of digital systems.

For businesses, however, the challenge goes beyond preventing attacks. They also need to be able to detect a breach quickly and limit its impact if their defences are compromised.

Munjal Kamdar, Partner at Deloitte India, believes organisations must prepare for this possibility, regardless of how much they invest in cybersecurity. In an interview with CNBC-TV18, he explained how attackers exploit weaknesses in third-party vendors, why continuous monitoring matters and how businesses can protect their most critical data and applications.

“The ability to detect that you have been compromised is very important,” Kamdar said, highlighting the need to identify affected assets, quarantine them and recover from an attack.

Why preventing every cyberattack is difficult Banking, retail, finance and other business operations increasingly depend on digital systems. A vulnerability in widely used software can therefore expose organisations across countries and sectors, making cybersecurity a persistent challenge.

Kamdar said around 133 vulnerabilities are discovered every day. The widespread use of PHP, a programming language used to build websites, illustrates how a flaw in commonly deployed technology can have far-reaching consequences.

Artificial intelligence is adding another dimension to the threat. Kamdar said advanced AI models can automate the discovery of vulnerabilities and help exploit them, allowing attackers to operate at a sustained pace.

“This adds a certain amount of velocity,” he said, distinguishing this from speed alone.

For businesses, this means that preventive controls, while essential, cannot be their only line of defence. They also need to recognise when an attacker has gained access and respond before the breach spreads to other systems.

How hackers use third-party vendors to target large organisations Large banks invest substantial resources in protecting their infrastructure, which can make their core systems difficult to compromise directly. Attackers may instead target smaller vendors and outsourced service providers that have access to these systems.

Kamdar described large banks' core infrastructure as “motherships”. He explained that attackers have increasingly sought to compromise a third party before moving laterally into the larger organisation. This creates a potential weakness even when a business has strong security controls of its own. If a vendor has inadequate defences, the relationship between the two organisations can provide attackers with another route into the larger company's systems.

Businesses therefore need to assess the security of their external service providers and monitor the access those providers have to their infrastructure. Kamdar noted that regulators, including the Reserve Bank of India (RBI), have guidelines governing third-party risk management for banks.

The issue is not simply whether a company has secured its own network. It must also understand the risks introduced by the organisations on which it depends.

Why detecting a breach quickly matters Even when businesses have preventive measures in place, they need to monitor their systems for signs of compromise. Kamdar said this is where security operations, commonly known as SecOps, play an important role.

Continuous monitoring helps organisations identify suspicious activity and respond to an intrusion. Once a compromise is detected, the affected assets can be quarantined, the exploit addressed and systems recovered.

The objective is to contain the incident before it spreads further and disrupts more of the business. Delayed detection can leave an organisation exposed for longer, while a timely response can help it resume normal operations more quickly.

Kamdar also stressed the importance of identifying an organisation's most critical applications and data, which he referred to as its “crown jewels”.

Not every application has the same importance. Businesses need to know which systems hold critical customer information or support essential operations so they can prioritise their protection. This helps limit potential data loss and financial damage if an attack succeeds. What can everyday users do to protect themselves?

While businesses must manage software vulnerabilities and third-party risks, individuals also need to protect their accounts and devices.

Kamdar said users should be particularly careful about phishing attempts, in which attackers send messages that appear to come from a bank, a relative or another trusted source. These messages may ask recipients to click on a link and enter their passwords or one-time passwords (OTPs).

Users should avoid sharing such information in response to unsolicited messages and keep the operating systems on their phones, tablets and computers updated. Software providers regularly release patches, and installing relevant updates helps address known vulnerabilities.

Kamdar also advised people to monitor their bank balances and credit card activity for unexpected changes. Since financial gain is a major motivation for attacks on banks, unusual transactions should not be ignored. Reporting suspicious activity to the bank promptly can help limit potential losses.

He said major banks in India have sophisticated security teams and are generally equipped to handle cybersecurity incidents. Users, however, should remain alert to activity in their own accounts rather than assume their bank's security measures will prevent every loss.

Why there is no need to panic Kamdar said cybersecurity has improved over the 25 years he has worked in the field, even as attackers have developed more potent methods. He believes individuals and organisations should remain vigilant without allowing fear to undermine sensible precautions.

“I'm a very optimistic person by nature, and over the last 25 years, I've only seen cybersecurity getting better and better, even though the exploits have become more and more potent,” he said.

For businesses, the priority is to combine preventive security measures with the ability to identify and contain a breach. As cyber threats evolve, being prepared to respond effectively can help limit the damage when an attack gets through.