Synopsis:
A new TTBS-CMR study says 84% of Indian SMEs plan to increase cybersecurity investments over the next 12–24 months. However, gaps in continuous monitoring, cybersecurity expertise and post-incident improvements remain a concern.
Indian small and medium enterprises (SMEs) are planning to spend more on cybersecurity as digital threats continue to evolve. According to the SME Digital Insights 2026: Cybersecurity study by Tata Tele Business Services (TTBS) and CyberMedia Research (CMR), 84% of Indian SMEs plan to increase their cybersecurity investments over the next 12–24 months.
The study also highlights a gap between planned investment and actual cybersecurity readiness. While businesses are preparing to increase spending, many still rely on reactive security practices and lack continuous monitoring capabilities.
40% of SMEs Experienced a Cyber Incident
The study found that 40% of SMEs experienced a cyber incident during the last 24 months. However, only 28% implemented structural cybersecurity improvements after the incident. Instead, 60% of SMEs responded by making tactical upgrades to individual security tools rather than strengthening their overall cybersecurity posture. This suggests that simply adding more security products may not be enough if businesses do not also improve their overall security processes, monitoring and response capabilities.
Only 12% Continuously Monitor Cybersecurity
Continuous monitoring remains another major gap. Only 12% of SMEs said they continuously monitor their cybersecurity environments. Around 35% operate multiple cybersecurity tools but have limited visibility into their overall risks. With businesses increasingly depending on digital systems for operations, payments, customer data and communication, having visibility across different security systems can become increasingly important.
Lack of Cybersecurity Expertise is a Major Challenge
Technology is not the only challenge. The study found that 45% of SMEs consider a lack of cybersecurity expertise their biggest barrier to implementing effective security measures. This means that increasing cybersecurity budgets may also require businesses to focus on skilled professionals, security management and external expertise where required.
Many SMEs Still Spend Less Than 5% of Their IT Budget on Security
Despite the planned increase in spending, 46% of SMEs currently allocate less than 5% of their IT budgets to cybersecurity. Medium-sized businesses appear particularly focused on increasing investment, with 89% planning to increase cybersecurity spending over the next 12–24 months. The findings indicate that cybersecurity is gradually being treated as a broader business priority rather than only an IT responsibility.
AI is Bringing Both Opportunities and Risks
Artificial intelligence is also becoming part of the cybersecurity strategy for Indian SMEs. The study found that 35% of SMEs recognise AI as a cybersecurity enabler, particularly for faster threat detection, automated monitoring and improved incident response. At the same time, 34% of SMEs expect AI-powered cyber threats to have a material impact on their businesses over the next 12–24 months. This creates a dual challenge for businesses: they can use AI to strengthen their security capabilities while also preparing for increasingly sophisticated AI-assisted threats.
What the Findings Mean for Indian SMEs
The study shows that Indian SMEs are increasingly willing to invest in cybersecurity, but spending alone may not close the readiness gap. Businesses may also need to focus on continuous monitoring, better visibility, skilled cybersecurity expertise and stronger post-incident improvements. As more SMEs move their operations online and adopt AI and other digital technologies, cybersecurity is likely to become increasingly connected to overall business resilience.
Source: CyberMedia Research (CMR)
Leave a Reply