How Data Centres Are Fighting Back Against a New Wave of Cyber Threats

India's data centre industry is at an inflexion point. Over the past three years, the country has emerged as one of the fastest-growing markets for digital infrastructure in the world, driven by surging cloud adoption, a booming start-up ecosystem and an aggressive government push to localise data processing. 

Hyperscale campuses are emerging on the outskirts of Mumbai, Chennai, Hyderabad and Bengaluru, while a fresh wave of edge facilities is expanding into Tier-2 and Tier-3 cities to meet the demands of a population coming online at an extraordinary pace. 

Yet alongside this expansion runs a parallel and far less welcome trend: a dramatic escalation in the sophistication and frequency of cyberattacks targeting the very infrastructure that underpins India's digital economy.

The nature of the threat has changed profoundly. Cybercriminals are no longer content to batter the walls of a network from the outside. Instead, they are slipping through the front door, armed with stolen credentials, hijacked service accounts and AI-generated phishing lures so convincing they routinely bypass automated defences. 

The perimeter, that long-standing boundary separating trusted networks from hostile ones, is no longer a meaningful concept in environments where workloads span multiple clouds, vendors rotate in and out of privileged access, and APIs quietly carry sensitive data between systems. 

Security professionals are increasingly candid: the old model is broken, and a new one must take its place.

Identity Is the New Perimeter

Kunal Ruvala, Senior Vice President and General Manager for India at Palo Alto Networks, says that the most important conceptual shift for Indian data centres is to stop asking whether a connection originates inside or outside a boundary, and start asking whether a specific user, system or workload should be permitted to carry out a specific action at a specific moment.

"That means continuously checking identity, access and behaviour across the data centre environment, especially for privileged users, machine accounts and systems with broad permissions," he tells AIM. "Attackers are increasingly logging in through stolen credentials or excessive access, so data centres need to reduce standing privileges and verify trust throughout the session."

This philosophy, often described as Zero Trust Architecture, is gaining traction across the industry. 

Pankaj Malik, Chief Executive of Invenia-STL Networks, observes that Indian data centres are adopting a "never trust, always verify" approach, in which every user, device, and application must be continuously authenticated, authorised, and validated before being granted access to critical resources. “The effect is a real-time risk assessment capability that limits lateral movement and makes credential-based intrusions significantly harder to execute,” he tells AIM.

AI Versus AI

If identity represents the new battleground, artificial intelligence is the weapon of choice on both sides. Ruvala points to research from Palo Alto Networks' Unit 42 threat intelligence team, which has documented how AI is compressing the attack lifecycle. In the fastest cases observed, adversaries moved from initial access to data exfiltration in just 72 minutes, a pace that renders traditional, human-driven incident response dangerously slow.

For Indian data centres, Ruvala says, the priority must be deploying AI to detect abnormal behaviour before it cascades into operational disruption. "That means looking for early signals across users, workloads, endpoints, network traffic and cloud environments — not waiting for a known malware signature or a confirmed breach. The real value of AI is pattern recognition at scale."

Meanwhile, Malik describes the challenge in starker terms. Attackers, he says, are now using AI to write polymorphic malware that mutates with every execution, rendering yesterday's defences irrelevant. His company's response has been to embed AI-driven anomaly detection directly into the infrastructure layer, so that deviations from normal behaviour are flagged and contained before they reach critical systems.

"When attackers are using AI to accelerate breaches, the only credible defence is infrastructure that can think, adapt, and respond in real time," Malik says, "often faster than human intervention allows."

The Vulnerability at the Edge

As India's data centre footprint extends beyond the major metros, a new risk is emerging. Edge nodes in Tier-2 and Tier-3 cities frequently lack the seasoned security teams and mature operational processes that characterise facilities in established hubs. For attackers, a single poorly secured edge facility represents an entry point into a far broader and more valuable interconnected ecosystem.

Ruvala is clear that the answer lies not in restricting expansion but in ensuring that security architecture travels with it. Every edge node, regardless of its geography, should operate with the same visibility, identity controls, network segmentation and automated monitoring as the core data centre. Critically, he argues, AI and automation must serve as force multipliers in regions where specialist cybersecurity talent remains scarce.

"India will not solve the cybersecurity talent gap overnight," he says, "so operational consistency and centralised visibility will matter far more than geography alone."

Ruvala also points to longer-term investment in human capital, citing Palo Alto Networks' SecurED faculty development programme, which aims to bring industry-relevant cybersecurity training into classrooms and help build a skilled local workforce commensurate with the scale of India's digital ambitions.

Malik draws the same conclusion about location-independent security baselines. Whether a facility sits in Mumbai or a smaller city, it must meet identical standards — the same zero-trust access controls, the same encrypted traffic protocols, the same AI-driven monitoring stack.

Resilience Over Prevention

The consensus among security professionals and analysts is increasingly that a breach is not merely possible but, in complex environments, essentially inevitable. The meaningful question has shifted from whether an organisation will be compromised to how quickly it can detect, contain, and recover once it is compromised.

Ng Yijing, Director of Corporate Ratings at S&P Global Ratings, places the rising cyber threat in a broader context. She notes that new technologies such as quantum computing and AI are amplifying the risk landscape, with AI enabling the mass production of traditional attacks and making it easier to bypass established security measures. Geopolitical tensions, she adds, have further elevated the global threat level.

"While cyberattacks may therefore not always be in the full control of data centre operators, the fallout in terms of renewal, remediation and reputation would be theirs to bear," Ng cautions.

Yijing also points to the Digital Personal Data Protection Act of 2023 as a positive regulatory development, one that imposes clear obligations on data fiduciaries and operators to implement security safeguards and includes financial penalties for non-compliance. 

Cyber insurance, she observes, may offer a degree of financial protection, though policies can be complicated by "act of war" exclusion clauses and the inherent difficulty of attributing attacks to specific actors.

On the operational side, Ruvala says that ‘Mean Time to Detect’ and ‘Mean Time to Respond’ are the metrics that matter most, and that both must increasingly be measured in minutes rather than days in critical environments. He argues that AI-assisted triaging in security operations centres can surface weak signals earlier, correlate anomalous activity across environments, and reduce analyst fatigue, thereby preventing critical alerts from being buried under routine noise.

Malik echoes the point, emphasising that resilience must be actively stress-tested through regular cyber drills, ransomware recovery simulations and red-team exercises that probe every layer of the infrastructure under controlled conditions.

The ambition, he says, is straightforward: to ensure that a security incident remains a manageable operational disruption rather than escalating into a prolonged crisis. 

In an industry that now underpins everything from banking and healthcare to the daily digital lives of hundreds of millions of Indians, that distinction is no longer academic — it is existential.