TheDPDPAct.com -
Official WhatsApp Channel
Stay updated with the latest DPDP Act news, compliance insights, updates, and resources.
Join Our WhatsApp Channel →Every security budget meeting ends the same way. Someone from finance asks what the return is, and the room goes quiet. Security spending has always been hard to defend because its best outcome is something that never happens. This year, IBM handed security leaders a rare piece of evidence. In its 2026 Cost of a Data Breach Report, India's single largest cost-reducing factor was not a tool, a platform, or a headcount increase. It was offensive security testing: the red teaming and penetration testing that many companies still treat as an annual compliance chore.
The Ledger: What a Breach Costs in India Now
IBM's 2026 report puts the average cost of a data breach in India at a record INR 25.5 crore, up 15.9% from INR 22 crore a year earlier. The average incident exposed 39,500 records. Cost varies sharply by sector: financial services averaged INR 40.9 crore, technology INR 35.7 crore, and communications INR 34.5 crore.
The global picture is no gentler. The worldwide average reached $4.99 million, a 12% jump that erased the previous year's decline. Detection and containment also slowed, with breaches taking an average of 247 days to identify and contain, the first deterioration in five years. IBM's data shows why that matters: breaches lasting more than 200 days averaged $5.65 million, against $4.32 million for those contained faster, roughly 31% more.
The Line Item That Stands Out
Against that backdrop, one finding deserves a closer look. IBM identified offensive security testing, including red teaming and penetration testing, as the largest cost-reducing factor in India, associated with an average saving of INR 2.47 crore per breach. Proactive threat hunting and AI governance technology followed.
For a finance team, that reframes the question. Testing is no longer only a cost that satisfies an auditor. It sits on the same ledger as breach losses, and in India it ranked first among the factors IBM measured.
Read the Number Carefully
Authority means being precise about what a statistic proves, so here is what INR 2.47 crore does and does not say.
It is an average drawn from IBM's research across many organizations. It describes an association, not a guarantee. Companies that test offensively are often more mature in other ways too, so the figure should not be read as "buy a pentest, save INR 2.47 crore." It is directional evidence that organizations which actively attack their own defenses tend to lose less when something goes wrong.
That is still a strong signal. It just belongs in your business case as supporting evidence, alongside your own risk numbers, not as a promised return.
Why Offensive Testing Moves the Number
The mechanics behind the correlation are straightforward, and they are worth understanding because they tell you how to get value from a test.
* It finds the exploitable gap first. A vulnerability scanner reports what might be wrong. A penetration test proves what an attacker can actually do with it, which is the difference between a backlog item and a priority.
* It shortens the clock. Given how strongly breach cost tracks lifecycle length, anything that speeds up detection pays off. A red team exercise measures whether your monitoring notices a real intrusion, and how long it takes your team to respond.
* It validates controls you already own. Many organizations have invested in SIEM, EDR, and access controls. Testing shows whether those investments work under adversarial pressure or only on a dashboard.
* It translates technical risk into business terms. An attack path to your customer database is easier to fund than a CVSS score.
The Spending Paradox
IBM's India findings include an uncomfortable detail. Nearly 73% of organizations said they planned to strengthen security investment after a breach, with incident response planning and testing the top priority at 67%. In other words, many companies make the investment after receiving the invoice.
The same activities cost far less before an incident than after one. Testing your incident response plan in a tabletop exercise is cheap. Discovering it does not work during a live breach is not.
Match the Test to the Risk
Not every organization needs every kind of test. A practical way to choose:
* Vulnerability assessment and penetration testing (VAPT) suits web applications, mobile apps, APIs, and networks. It answers: what can be exploited in the systems we run?
* Red teaming simulates a determined adversary pursuing a goal, such as reaching customer data. It answers: would we detect and stop a realistic attack?
* AI red teaming targets language models and agents. IBM found that roughly one in four malicious breaches this year was AI-enabled, adding about $1 million to the average cost, while shadow AI added INR 1.79 crore in India. If you have shipped an AI feature, it belongs in scope.
Five Conditions That Make Testing Pay
A test only reduces risk if what it finds gets fixed. These habits separate programs that cut losses from those that produce shelfware reports.
1. Scope around crown jewels. Test the systems whose compromise would hurt most, not just whatever is easiest to schedule.
2. Set fix deadlines before the test starts. Agree remediation timelines by severity so findings do not age in a backlog.
3. Always retest. A fix that has not been verified is an assumption.
4. Test after major change. A cloud migration or a new AI feature alters your attack surface. IBM lists cloud migration among India's top three cost-increasing factors, so change events deserve fresh testing.
5. Report in business terms. Give leadership attack paths, potential impact, and trends across test cycles, not just vulnerability counts.
Run Your Own Numbers
Instead of borrowing IBM's average, build your own comparison. Start with the cost of a breach in your sector, using the INR 40.9 crore financial services figure or the technology figure as a reference point. Estimate how much a testing program would reduce the likelihood or duration of a serious incident, then compare that against the program's cost. Even a modest reduction in likelihood can outweigh the price of testing when the downside runs into tens of crores.
Add the exposures that sit outside the breach average: regulatory penalties, customer churn, and the management time a major incident consumes. Under India's data protection law, those penalties can be substantial. Most budget debates look very different once those lines are included.
The Bottom Line
Security leaders have spent years struggling to prove the value of prevention. IBM's 2026 India data does not settle the argument, but it moves it onto firmer ground: among the factors the study measured, offensive testing ranked first for reducing breach costs. Treat the figure as evidence, not a promise, then do the harder work of scoping tests well, fixing what they find, and retesting.
Organizations that attack their own defenses on their own terms tend to pay less when someone else does it on theirs.
