Resources Categories
INDUSTRY FACT FILE · AI, ANALYTICS & AUTOMATION
Applicable Cybersecurity Services and Codec Networks Bundles for AI
How Codec Networks services and bundled service models help AI builders and adopters resolve AI threats and meet India's AI guidelines, IT Rules, DPDP and sector expectations.
|
In this document 1. Our approach 2. Mapping threats to services 3. Codec Networks service catalogue for the sector 4. Codec Networks bundles for the sector 5. Sector programmes built from the bundles 6. Packages: Foundation, Assurance and Continuous Resilience 7. Regulatory requirement-to-bundle mapping 8. Threat-to-bundle coverage matrix 9. Delivery methodology and deliverables 10. Why Codec Networks 11. Annex: indicative commercial ranges |
1. Our approach
AI needs assurance across data, models, applications and actions. Codec Networks works on four principles:
- Assume untrusted input: test every path content takes into the model.
- Limit what AI can do: scoped tools, approvals and monitoring for agents.
- Protect the data: lawful training data, per-user retrieval and leakage testing.
- Govern and evidence: policies, inventories and ISO/IEC 42001-aligned controls.
2. Mapping threats to services
The table maps the 18 threats identified in Document 4 of this set to the Codec Networks services that help mitigate them.
|
Threat / challenge |
Applicable Codec Networks services |
Intended outcome |
|
Direct prompt injection |
Jailbreak and guardrail testing |
Resilient guardrails |
|
Indirect prompt injection |
Indirect injection testing via documents and tools |
Instructions separated from content |
|
Sensitive data leakage |
Output leakage testing, filtering review |
No sensitive data in answers |
|
Excessive agency |
Agent permission and approval review |
Bounded agents |
|
Cross-user retrieval |
Retrieval authorisation testing |
Permission-aware RAG |
|
Training-data privacy |
DPDPA review, PII redaction |
Lawful training data |
|
Data and model poisoning |
Data pipeline and fine-tuning review |
Trusted training |
|
Malicious models |
Model provenance and scanning review |
Approved models only |
|
Model theft |
AI infrastructure and API security review |
Protected weights |
|
Deepfake fraud |
Deepfake simulations, payment control testing |
Verified instructions |
|
Insecure plug-ins |
Connector and API testing |
Authorised tools |
|
Shadow AI |
AI usage policy, DLP, approved tools |
Controlled AI use |
|
Harmful output |
Output safety evaluation |
Safer answers |
|
Bias |
Model governance and fairness review |
Accountable decisions |
|
Denial of wallet |
Rate limiting and abuse testing |
Controlled costs |
|
System prompt exposure |
Prompt and secrets review |
Protected configuration |
|
Weak oversight |
AI logging and monitoring design |
Auditable AI |
|
Insecure AI infrastructure |
AI platform and cloud review |
Hardened platforms |
3. Codec Networks service catalogue for the sector
|
Service line |
Sector-relevant services |
|
Emerging technology security (AI/LLM) |
Prompt injection, jailbreak, RAG, agent and output safety testing; AI red teaming |
|
Application, API & DevSecOps security |
AI application, API, plug-in and connector testing; MLOps pipeline security |
|
Data privacy & protection |
DPDPA programmes for AI data, PII redaction, consent and retention, leakage testing |
|
Information security audit & compliance |
ISO/IEC 42001 readiness, AI policy and inventory, sector AI framework alignment |
|
Cloud security |
AI platform, GPU cloud, model server and vector store security |
|
Third-party risk management |
Model provider, dataset and AI tool assessments |
|
24/7 Managed SOC & threat monitoring |
AI usage, abuse and agent action monitoring |
|
Offensive security & simulation |
Deepfake and AI-enabled social engineering simulations |
|
Cyber forensics |
AI incident investigation and root-cause analysis |
4. Codec Networks bundles for the sector
Eleven of the twelve bundles in the Codec Networks Bundled Service Models apply directly to AI builders and adopters; the Global Cyber Back-Office SPV Program (Bundle 12) is offered separately for international clients.
Figure 6: Codec Networks bundles applied to the sector.
|
Bundle |
Name |
Sector-relevant scope |
Best suited for |
Key deliverables |
|
B1 |
Cyber Assessment & VAPT Assurance Program |
AI application and infrastructure VAPT |
All AI builders |
PT reports and closure tracker |
|
B2 |
Application, API & DevSecOps Security Program |
LLM app, RAG, agent and connector testing |
Chatbot and agent developers |
AI application risk report |
|
B3 |
Cloud, Infrastructure & Zero Trust Security Program |
AI platform, GPU cloud and vector store reviews |
AI platforms and self-hosters |
Platform security review |
|
B4 |
Regulatory Cybersecurity Audit & Compliance Assurance Program |
Sector AI framework alignment (e.g. RBI FREE-AI) |
BFSI and regulated adopters |
Gap matrix, evidence index |
|
B5 |
GRC, ISO, SOC 2 & Cyber Maturity Program |
ISO/IEC 42001 readiness and AI governance |
Builders and adopters formalising AI |
Governance pack, risk register |
|
B6 |
Data Privacy, DPDPA & Data Protection Program |
DPDPA programme for AI data, leakage testing |
All AI teams ahead of May 2027 |
Privacy and leakage assessment |
|
B7 |
Managed SOC, MDR & Continuous Threat Monitoring Program |
AI usage and abuse monitoring |
Adopters and AI products in production |
Monitoring reports |
|
B8 |
Digital Forensics, Incident Response & Malware RCA Program |
AI incident investigation |
Any organisation facing an AI incident |
Forensic report and RCA |
|
B9 |
Third-Party Risk Management & Supply Chain Cyber Risk Program |
Model provider and dataset assessments |
Teams using third-party models |
Vendor risk assessments |
|
B10 |
Cyber Simulation, Awareness, Tabletop & Crisis Readiness Program |
Deepfake and AI social-engineering simulations |
Finance, executives and help desks |
Exercise reports |
|
B11 |
Emerging Technology, AI, Web3 & Future Security Program |
Continuous AI red teaming and model risk |
Large AI deployments |
AI risk assessment |
5. Sector programmes built from the bundles
Codec Networks packages the catalogue bundles into six AI programmes.
|
Programme |
Built from bundles |
Challenges addressed |
|
AI Application Security |
B11, B2 |
Prompt injection, RAG and agents |
|
AI Data Protection |
B6 |
Training data, leakage and DPDP |
|
AI Governance Programme |
B5, B4 |
Policy, inventory, ISO/IEC 42001, sector frameworks |
|
Model Supply Chain Assurance |
B9, B3 |
Models, datasets and platforms |
|
Deepfake & Fraud Resilience |
B10, B7 |
Impersonation and payment fraud |
|
AI Monitoring & Response |
B7, B8 |
Abuse detection and AI incidents |
6. Packages: Foundation, Assurance and Continuous Resilience
|
Package element |
Foundation |
Assurance |
Continuous Resilience |
|
Typical organisation |
Start-ups and pilot projects |
Scaling AI products and adopters |
Large enterprises and AI platforms |
|
Testing |
B11: LLM application test |
B11 + B2: RAG, agent and API testing |
B11 + B10: continuous AI red teaming |
|
Audit and GRC |
B5: AI usage policy pack |
B5: ISO/IEC 42001 readiness |
B5 + B4 + B9: governance, sector alignment and supply chain |
|
Cloud and privacy |
B6: DPDPA quick assessment |
B6 + B3: leakage testing and platform review |
B6 + B3: continuous data and platform assurance |
|
Monitoring and response |
IR retainer (B8) |
B7: AI usage monitoring + B8 |
B7: SOC with AI abuse signals + B8 |
|
Reporting |
Launch-readiness report |
Customer and management reporting |
Board and regulator reporting |
7. Regulatory requirement-to-bundle mapping
|
Requirement (source) |
How Codec Networks helps |
Bundle |
|
Principles-based AI governance (India AI Governance Guidelines, 2025) |
AI governance framework, inventory and risk register |
B5, B11 |
|
Synthetic content labelling and takedowns (IT Rules amendment, 2026) |
Labelling and takedown process review |
B4 |
|
Lawful processing of personal data in AI (DPDP) |
DPDPA programme for AI data |
B6 |
|
Cyber incidents to CERT-In within six hours |
AI monitoring and IR support |
B7, B8 |
|
Responsible AI in financial services (RBI FREE-AI) |
Model risk and governance assessment |
B4, B11 |
|
AI management systems (ISO/IEC 42001) |
Readiness and implementation |
B5 |
|
AI risk management (NIST AI RMF) |
Risk assessment aligned to the framework |
B11 |
|
Secure AI applications (customer contracts) |
AI/LLM and agent security testing |
B2, B11 |
|
Auditor eligibility and independence Where a regulator, standard or contract requires CERT-In empanelled or independent auditors, Codec Networks—CERT-In empanelled for information security auditing services—confirms eligibility and independence in each proposal. |
8. Threat-to-bundle coverage matrix
|
Threat / challenge |
Primary bundle |
Supporting bundles |
|
Direct prompt injection |
B11 |
B2 |
|
Indirect prompt injection |
B11 |
B2 |
|
Data leakage |
B6 |
B11 |
|
Excessive agency |
B11 |
B3 |
|
Cross-user retrieval |
B2 |
B6 |
|
Training-data privacy |
B6 |
B5 |
|
Poisoning |
B11 |
B9 |
|
Malicious models |
B9 |
B3 |
|
Model theft |
B3 |
B2 |
|
Deepfake fraud |
B10 |
B7 |
|
Insecure plug-ins |
B2 |
B11 |
|
Shadow AI |
B5 |
B6 |
|
Harmful output |
B11 |
B5 |
|
Bias |
B11 |
B4 |
|
Denial of wallet |
B2 |
B7 |
|
System prompt exposure |
B11 |
B2 |
|
Weak oversight |
B7 |
B5 |
|
Insecure AI infrastructure |
B3 |
B1 |
“Primary” and “supporting” indicate suggested combinations, not guaranteed mitigation or complete coverage.
9. Delivery methodology and deliverables
Figure 7: The Codec Networks delivery methodology.
Typical deliverables include AI/LLM and agent test reports with retests, a data leakage and retrieval assessment, a training-data privacy review, a model supply-chain review, an AI policy, inventory and risk register, ISO/IEC 42001 readiness findings and AI monitoring reports.
10. Why Codec Networks
- CERT-In empanelled for information security auditing services, and empanelled with NICSI for application audit and compliance services (start-up category).
- Certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018.
- Full stack: VAPT, regulatory audit, managed SOC, forensics, privacy and Board advisory from one partner, so findings, monitoring and closure stay connected.
- AI depth: prompt injection, RAG, agents, training data and model supply chain tested the way attackers use them.
- Recognised frameworks and tools: OWASP ASVS/MASVS and API Top 10, MITRE ATT&CK, NIST CSF, ISO 27001 and PCI DSS; tools such as Burp Suite, Nessus, Metasploit, Prowler and leading SIEM/EDR platforms.
- Certified people: CEH, OSCP, CPENT, CISA, ISO 27001 LA/LI, CHFI, CTIA and ECIH professionals.
Annex: Indicative commercial ranges
For internal sales reference only—remove this annex before sharing externally. Ranges are taken from the Codec Networks Bundled Service Models and are subject to scoping, asset counts, frequency and service levels.
|
Bundle |
Package examples and indicative ranges |
|
B1 VAPT Assurance |
Essential ₹1.5–5 lakh; Professional ₹5–15 lakh; Enterprise ₹15–40 lakh; Annual retainer ₹25 lakh–₹1.5 crore |
|
B2 AppSec & DevSecOps |
API Quick Check ₹2–6 lakh; AppSec Professional ₹8–20 lakh; DevSecOps Maturity ₹12–35 lakh; Secure SDLC retainer ₹3–15 lakh/month |
|
B3 Cloud & Zero Trust |
Cloud Essential ₹3–8 lakh; Professional ₹8–25 lakh; Enterprise ₹25–75 lakh; Continuous assurance ₹2–10 lakh/month |
|
B4 Regulatory Audit |
Gap review ₹5–15 lakh; Full regulatory audit ₹15–50 lakh; Multi-framework audit ₹30 lakh–₹1.25 crore; Annual retainer ₹3–20 lakh/month |
|
B5 GRC, ISO, SOC 2 |
ISO readiness ₹5–15 lakh; ISO implementation ₹15–45 lakh; SOC 2 readiness ₹15–60 lakh; GRC retainer ₹2–12 lakh/month |
|
B6 Privacy & DPDPA |
Quick assessment ₹3–10 lakh; Implementation ₹10–40 lakh; DPO-as-a-Service ₹2–8 lakh/month; Privacy retainer ₹3–15 lakh/month |
|
B7 Managed SOC |
Starter ₹2–5 lakh/month; Professional ₹5–15 lakh/month; Enterprise ₹15–50 lakh/month; co-managed per FTE/shift |
|
B8 Forensics & IR |
Triage ₹3–15 lakh; Full investigation ₹15–75 lakh; Ransomware response ₹25 lakh–₹1.5 crore; IR retainer ₹5–50 lakh/year |
|
B9 TPRM |
₹25,000–₹2 lakh per vendor; batch pricing for 50–500 vendors; retainer ₹3–25 lakh/month |
|
B10 Simulation & Tabletop |
Awareness ₹1–5 lakh; Phishing simulation ₹2–10 lakh; Tabletop ₹5–20 lakh; Cyber war-game ₹15–75 lakh; Annual retainer ₹10 lakh–₹1 crore/year |
|
B11 Emerging Tech |
AI/LLM risk review ₹5–25 lakh; Smart contract audit ₹5–50 lakh; Emerging tech retainer ₹5–25 lakh/month |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: Service scope, deliverables, monitoring coverage and service levels are confirmed during engagement scoping. Services support risk reduction and assurance but do not guarantee prevention of all cyber incidents or regulatory compliance. Regulatory references are summaries; confirm against the official instruments applicable to each entity.