INDUSTRY FACT FILE · AGRICULTURE & AGRITECH

Industry Overview: Agriculture and Agritech in India

Who produces, supplies, finances, stores and trades India's farm output, the digital platforms they run, the rules that apply and why each segment needs its own security approach.

Indian agriculture is being rebuilt on digital public infrastructure. On 2 September 2024 the Union Cabinet approved the Digital Agriculture Mission with an outlay of ₹2,817 crore, including a central share of ₹1,940 crore, as an umbrella scheme for AgriStack, the Krishi Decision Support System and soil profile mapping. AgriStack is built from three registries created and maintained by states and union territories: a Farmers' Registry with authenticated demographic, landholding and crop details, geo-referenced village maps, and a Crop Sown Registry fed by the Digital Crop Survey. Progress has been rapid. In a written reply to the Rajya Sabha in August 2026 the government reported more than 10.31 crore Farmer IDs created as of 3 August 2026, against a target of 11 crore by March 2027, and the Digital Crop Survey covered more than 31 crore plots in 648 districts in Rabi 2025-26. These registries are designed to be used by banks, insurers, input firms and agritech platforms, with the farmer's consent, to deliver credit, insurance, advisory and market services faster.

Money and markets have moved online alongside the registries. PM-KISAN, launched in February 2019, pays eligible farmers ₹6,000 a year in three instalments by direct benefit transfer; the 23rd instalment, released on 20 June 2026, reached more than 9.44 crore farmers, and the government reports more than ₹4.46 lakh crore disbursed since launch. The electronic National Agriculture Market (e-NAM), launched in April 2016, had integrated 1,656 mandis and registered about 1.80 crore farmers and 2.72 lakh traders by March 2026, with cumulative trade worth about ₹4.84 lakh crore. Kisan Credit Cards remain the backbone of farm credit, with more than 7.7 crore operative accounts reported for December 2024, and the Union Budget 2025-26 raised the limit for loans under the Modified Interest Subvention Scheme from ₹3 lakh to ₹5 lakh. The Warehousing Development and Regulatory Authority (WDRA) supports electronic negotiable warehouse receipts (e-NWRs) from accredited warehouses, and a ₹1,000 crore Credit Guarantee Scheme for e-NWR based pledge financing was launched on 16 December 2024. The government reported in February 2025 that the target of forming 10,000 farmer producer organisations had been met.

Private agritech has grown around this infrastructure. Precision farming firms sell soil, weather and irrigation sensors with cloud dashboards; machinery makers and custom hiring centres use telematics; drone service providers spray crops, supported by schemes such as Namo Drone Didi, a ₹1,261 crore programme to provide drones to women's self-help groups; marketplaces connect farmers and FPOs with buyers, input suppliers and lenders; and agri-credit platforms use land records, crop data and warehouse receipts to underwrite loans. Every one of these models runs on connected devices, mobile apps, APIs, payment gateways and cloud platforms, and many of them hold the personal, land and financial data of farmers who have little ability to protect themselves if it leaks.

Public incidents show how this exposure turns into harm. In August 2020 the Tamil Nadu government reported that login credentials of officials had been misused to register about 5.5 lakh ineligible beneficiaries on the PM-KISAN portal in 13 districts, with more than ₹110 crore transferred before district officials noticed the surge; arrests followed, login IDs were deactivated and recoveries began. In the United States, ransomware hit grain cooperatives NEW Cooperative and Crystal Valley in September 2021, at the height of harvest, after meat processor JBS paid US$11 million to end a ransomware attack in June 2021; in April 2022 the FBI warned that ransomware actors may time attacks on agricultural cooperatives to planting and harvest seasons. Researchers presenting at DEF CON in 2021 reported vulnerabilities in web systems of major farm equipment makers, which were fixed after disclosure. In India, CERT-In's Directions require incidents to be reported within six hours and ICT logs to be kept for 180 days, CERT-In's July 2025 audit guidelines cover risk-based audits including OT, RBI's digital lending rules apply to lenders and their platform partners, and the DPDP Act will govern farmer data, with most DPDP Rules obligations applying from May 2027.

Figure 1: India's agriculture and agritech ecosystem.

• The Ministry of Agriculture and Farmers Welfare runs the Digital Agriculture Mission, PM-KISAN, e-NAM and other schemes, while state agriculture and revenue departments build and maintain the AgriStack registries, land records and crop surveys.
• The Small Farmers' Agribusiness Consortium (SFAC) implements e-NAM, WDRA regulates warehouses and warehouse receipts, and the Department of Food and Public Distribution administers the e-NWR credit guarantee scheme.
• RBI regulates banks, NBFCs and digital lending, NABARD refinances and supports rural credit, cooperatives and FPOs, and insurers deliver crop insurance under PMFBY.
• CERT-In receives incident reports and issues advisories and audit guidelines; NCIIPC protects notified critical information infrastructure; DGCA administers the Drone Rules; MeitY frames IT and data policy, and the Data Protection Board enforces the DPDP Act.
• Agribusinesses, seed and agri-input companies, farm IoT and drone providers, marketplaces, warehouses, agri-credit platforms, FPOs and cooperatives run the services; farmers, dealers, traders, processors and exporters depend on them.
• Cloud providers, payment gateways, telecom operators, device makers, software integrators and common service centres sit inside almost every service, and their weaknesses become the platform's incidents.

Codec Networks is a CERT-In empanelled information security auditing organisation, empanelled with NICSI for application audit and compliance services (start-up category), and certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For agriculture and agritech businesses we deliver farm IoT security assessments covering sensors, field gateways, irrigation controllers, message brokers and device firmware and update processes; reviews of machinery telematics and agri-drone fleet and data platforms; VAPT of agritech marketplaces, farmer and dealer apps and the APIs that connect them to lenders, insurers, buyers and AgriStack or other public platforms; payment integration testing of gateways, UPI collections, payment callbacks, settlement and payout logic and DBT-linked flows; cloud configuration and storage exposure assessments; identity and field agent access reviews; OT and network assessments of warehouses, cold stores and processing sites; dealer portal and seed traceability code reviews; supplier and integrator assurance; CERT-In empanelled audits; ISO 27001 readiness and support for lender and buyer security requirements; DPDP programmes for farmer, land and borrower data; 24x7 managed SOC with harvest-season threat monitoring; and incident response and forensics for ransomware, payment fraud and data exposure. Device, drone and payment testing is carried out only with authorisation, in agreed windows that protect sowing, harvest and payout operations. Each proposal confirms auditor eligibility and independence against CERT-In's and the client's requirements. Codec Networks does not provide agronomic, scheme eligibility or lending advice.

Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, regulatory, lending, agronomic or scheme eligibility advice. Obligations differ by activity (agribusiness, seed and agri-input manufacture and sale, precision farming and farm IoT, agritech marketplaces and commodity platforms, warehousing, agri-credit or FPO and cooperative services), by the licences, accreditations, scheme integrations and lending partnerships held, by listing status, contracts and the data each organisation handles; confirm them against the official Ministry of Agriculture and Farmers Welfare, state government, WDRA, RBI, NABARD, DGCA, CERT-In, NCIIPC, MeitY and Data Protection Board instruments and your agreements. Testing of farm devices, drones and payment systems is described only as authorised testing in agreed windows and controlled conditions. Incident references are summarised from official statements and widely reported events.