Resources Categories
INDUSTRY FACT FILE · CONGLOMERATES, HOLDING COMPANIES & INVESTMENT GROUPS
Market Landscape and the Drivers of Cybersecurity Demand in Investment Groups
The business, technology, regulatory, legal and statutory forces that create governance, diligence, testing, monitoring and response work for business groups, holding companies, CICs, family offices, PE and VC firms and their companies.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: Companies Act, SEBI, RBI, CERT-In and DPDP 5. Legal and statutory drivers 6. How the drivers differ by organisation type 7. What this means for buyers and for Codec Networks |
1. Market landscape
India's corporate landscape is dominated by groups. Promoter-led business groups control a large share of listed market value through parents, holding companies and core investment companies, and run many more unlisted companies alongside them. Private capital is a growing part of ownership: Bain & Company's India Private Equity Report 2026 estimated PE and VC investment of about US$36 billion in 2025, down about 17% on the previous year because of fewer large deals, while deal numbers rose by nearly 10% to around 1,700 and exits held at about US$34 billion. Family offices of promoter families have become active investors in start-ups, funds and listed companies. Groups and funds are buying and integrating companies, restructuring through mergers and demergers, listing subsidiaries and building shared-services centres, all of which change who connects to whom and who holds which data.
Cybersecurity demand follows five pressures. Governance: the Companies Act, SEBI's LODR Regulation 21 and 27(2)(ba), RBI's CIC directions and SEBI's CSCRF make Boards, risk committees and fund managers answerable for cyber risk, and they need group-wide evidence. Transactions: acquirers, lenders and insurers ask for cyber due diligence, and the Marriott–Starwood and Verizon–Yahoo cases are standard reference points in deal negotiations. Systemic events: NotPetya in 2017 and the 2025 attack on Jaguar Land Rover showed that one company's incident can halt group companies, suppliers and dealers. Fraud: deepfake and email impersonation target treasury, family office and deal teams, and the FBI recorded US$2.77 billion of business email compromise losses in 2024. Concentration: shared directories, ERP and service centres mean one weakness affects many entities. Most holding companies, family offices and funds have small security teams and rely on external assessors, auditors, SOC providers and responders.
|
~1,700 PE-VC deals in India in 2025 (Bain) |
Top 1,000 Listed entities needing a risk committee (LODR) |
₹22 crore Average cost of a data breach in India (IBM, 2025) |
US$2.77 bn BEC losses reported to the FBI in 2024 |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Diversified groups and holdcos |
Groups consolidating IT and setting group-wide policies |
Group standard, maturity scoring, shared SOC, audits |
|
Core investment companies |
CICs building group risk governance and reporting |
Group risk reporting, independent reviews |
|
Family offices |
Offices professionalising investments, payments and staff |
Payment controls, privacy, awareness, device security |
|
PE and VC firms |
Funds formalising portfolio operations and CSCRF compliance |
Due diligence, portfolio baselines, CSCRF reviews |
|
Portfolio and group companies |
Companies asked by owners for evidence of controls |
VAPT, cloud reviews, SOC, recovery testing |
|
Acquisition platforms and shared services |
Platforms integrating acquired firms and serving many entities |
Integration gates, PAM, segregation, DPDP |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Buying a company |
Price protection and warranties depend on what is known |
Cyber due diligence, compromise assessment |
|
Integrating an acquisition |
Pressure to connect the target quickly |
Integration security gates, Day-1 monitoring |
|
Preparing an exit or listing |
Buyers and investors run their own diligence |
Exit readiness review, vendor diligence pack |
|
Reporting to the Board and risk committee |
Directors ask for group-wide, comparable metrics |
Maturity scoring, dashboards, independent audits |
|
Renewing cyber insurance |
Insurers ask for evidence of controls across entities |
Control attestations, insurance limit reviews |
|
Satisfying LPs and lenders |
Questionnaires on portfolio cyber governance |
Portfolio assessments, policy frameworks |
|
Protecting treasury and the family |
Impersonation and payment fraud attempts |
Treasury control testing, deepfake simulations |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Shared directories and identity |
One compromise reaches many entities |
Directory, trust and privileged access reviews |
|
Group ERP and shared services |
Concentrated financial and HR data and access |
Application and access reviews, segregation by entity |
|
Cloud tenants and SaaS sprawl |
Unmanaged tenants, weak identity, open storage |
Cloud configuration and SaaS posture assessments |
|
Data rooms and deal tools |
Leaks of UPSI and target data |
Data room and deal process security reviews |
|
OT in industrial group companies |
Production outages that ripple through supply chains |
OT assessments aligned with IEC 62443, CERT-In audits |
|
Generative AI and deepfakes |
Cloned executives, AI-written phishing |
Simulations, approval controls, awareness |
Figure 3: The four groups of drivers behind cybersecurity spending in groups and investment firms.
4. Regulatory drivers: Companies Act, SEBI, RBI, CERT-In and DPDP
|
Instrument |
Key requirements |
|
Companies Act 2013 |
Board's report statement on risk management policy; audit committee evaluation of risk management systems; independent directors' duties on robust risk management |
|
SEBI LODR Regulations 21 and 27(2)(ba) |
Risk management committee for the top 1,000 listed entities with a role that covers cyber security; quarterly disclosure of cyber incidents in corporate governance reports |
|
SEBI PIT Regulations 2015 |
Structured digital database of UPSI sharing with time stamps and audit trails; internal controls and inquiries into leaks |
|
SEBI CSCRF (August 2024) |
Cyber security and resilience framework for SEBI-regulated entities including AIF and portfolio managers, graded by category, with timelines extended and clarified in 2025 |
|
RBI CIC directions (revised 2020) |
Group risk management committee, independent directors and chief risk officers for larger CICs |
|
CERT-In Directions (2022) and audit guidelines (2025) |
Six-hour incident reporting; 180-day ICT logs in India; risk-based independent audits including OT and ICS |
|
DPDP Act 2023 and Rules 2025 |
Each group company as a data fiduciary; lawful basis for sharing data within the group, safeguards and breach intimation; most obligations from May 2027 |
|
Confirm applicability Obligations depend on each entity's listing status, registrations and regulatory category, the funds and mandates it manages, the sectors its companies operate in and its contracts. SEBI's CSCRF categories, thresholds and timelines for AIF and portfolio managers were clarified and extended during 2025 and should be checked against the latest circulars; confirm against the official instruments and your agreements. |
Figure 4: Legal and regulatory timeline shaping group and investment firm security, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
Companies Act, 2013 |
Directors' duties, Board's report, audit committee and independent director roles |
Board reporting, group risk reviews |
|
SEBI LODR and PIT Regulations |
Risk committees, cyber incident disclosure, UPSI controls |
RMC reporting, deal data controls, incident records |
|
SEBI AIF Regulations, 2012 and CSCRF |
Duties of fund managers, including cyber resilience |
CSCRF gap reviews and audits |
|
IT Act, 2000 |
Offences such as unauthorised access and identity theft; reasonable security practices |
VAPT, incident response, forensics |
|
DPDP Act, 2023 and Rules, 2025 |
Personal data of employees, customers and families across the group |
Group privacy programmes, data maps |
|
Transaction documents |
Cyber and data warranties, indemnities, conditions and covenants |
Due diligence, compromise assessments |
|
Insurance policies |
Cover, exclusions, conditions and notification duties |
Control evidence, limit and aggregation reviews |
6. How the drivers differ by organisation type
|
Organisation type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Diversified groups and holdcos |
Group resilience, Board scrutiny |
Shared directories, ERP, OT |
Companies Act, LODR, CERT-In, DPDP |
|
Core investment companies |
Group risk oversight |
Treasury, banking portals, reporting |
RBI CIC directions, Companies Act |
|
Family offices |
Family privacy, payment safety |
Email, devices, banking portals |
IT Act, DPDP, contracts |
|
PE and VC firms |
Portfolio value, exits, LP demands |
Data rooms, investor portals, investee IT |
AIF Regulations, CSCRF, DPDP |
|
Portfolio and group companies |
Owner and customer demands |
Own IT, cloud, OT and apps |
Sector rules, LODR, CERT-In, DPDP |
|
Acquisition platforms and shared services |
Fast, safe integration |
Integration tooling, shared ERP, outsourcers |
Contracts, CERT-In, DPDP |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“We sign a deal next month and know nothing about the target's security.” |
Cyber due diligence and compromise assessment |
Diligence on every deal above a set size |
|
“Our Board wants one view of cyber risk across all our companies.” |
Group maturity scoring and Board dashboard |
Annual group reassessment |
|
“One subsidiary's ransomware could reach everyone.” |
Directory, trust and segmentation review |
Shared SOC and annual red team |
|
“Our treasury got a call from the 'chairman' yesterday.” |
Treasury control testing and deepfake simulation |
Quarterly simulations and awareness |
|
“Our LPs and buyers ask about portfolio cyber risk.” |
Portfolio baseline and benchmarking |
Annual portfolio review and exit packs |
|
“We need to comply with SEBI's CSCRF as a fund manager.” |
CSCRF gap assessment and audit support |
Annual CSCRF audit cycle |
|
“Something is wrong at one of our companies.” |
Incident response, forensics and root cause analysis |
Group IR retainer and SOC |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, regulatory, investment, tax, transaction or insurance advice. Obligations differ by entity (diversified group company, listed or unlisted holding company, core investment company, family office, alternative investment fund or portfolio manager, portfolio company or shared-services centre), by listing status, registrations and regulatory category, by fund documents, transaction agreements, lender covenants and insurance policies, and by the data each entity handles; confirm them against the official MCA, SEBI, stock exchange, RBI, CERT-In, NCIIPC, MeitY and Data Protection Board instruments and your agreements. Pre-acquisition testing is described only as authorised work with the consent of the target and in agreed conditions. Incident references are summarised from official statements, regulator decisions and widely reported events, and no inference is drawn about the governance of any named organisation or its owners.