INDUSTRY FACT FILE · DEFENCE & STRATEGIC INDUSTRIES

Industry Overview: Defence and Strategic Industries in India

Who makes India's defence and strategic equipment, the security and cyber obligations that apply, who buys cybersecurity in the sector and why each type of organisation needs its own approach.

India's defence industrial base has changed more in the last six years than in the previous three decades. The Ministry of Defence reported record defence production of ₹1.78 lakh crore in 2025-26, up 15.6% from ₹1.54 lakh crore the year before, with defence PSUs and other public-sector units accounting for about 76% and the private sector for about 24%. Defence exports reached a record ₹38,424 crore in 2025-26, up from ₹23,622 crore in 2024-25, with equipment going to more than 80 countries and private firms contributing about 45% of export value. The Ministry of Defence received ₹7.85 lakh crore in the Union Budget for 2026-27, including about ₹1.85 lakh crore for capital acquisition. Behind those numbers sit the defence PSUs, the seven companies formed when the Ordnance Factory Board was dissolved on 1 October 2021, a growing group of private primes, thousands of MSME suppliers, DRDO laboratories and partners, iDEX start-ups and a fast-growing space and strategic electronics industry.

That growth widens the attack surface exactly where adversaries are most interested. Designs, drawings, source code, test results and programme schedules now move between DPSUs, private integrators, tier-2 and tier-3 suppliers, foreign partners and start-ups, often by email, file shares and collaboration portals that were never built for controlled information. State-linked groups pursue this information persistently. Security vendors including Seqrite, Sekoia and CYFIRMA have reported repeated campaigns by the Pakistan-linked groups known as Transparent Tribe (APT36) and SideCopy against Indian defence and government targets, using decoy documents themed on armed forces directives, postings and current events. During the India–Pakistan hostilities of May 2025, the Maharashtra Cyber police reported more than 1.5 million cyberattacks against Indian systems, and the website of at least one defence PSU was reported defaced. Ransomware groups, meanwhile, treat defence manufacturers like any other high-value industrial target.

International incidents show how these threats reach defence suppliers. In 2023 the LockBit ransomware group published data it claimed to have taken from Boeing, which confirmed a cyber incident affecting elements of its parts and distribution business and said flight safety was not affected. Rheinmetall said a Black Basta ransomware attack in April 2023 affected its civilian business but not its military business, because the group's IT infrastructure was strictly separated. Thales said that data published by LockBit in November 2022 came in part from a partner's account on a collaboration portal. In India, the Nuclear Power Corporation of India confirmed in October 2019 that malware had been found on an internet-connected administrative computer at Kudankulam after CERT-In alerted the Department of Atomic Energy; researchers identified the malware as DTrack, which they associate with the Lazarus group. Each case carries a lesson for defence industry: separate networks, control partner access and assume someone else may detect you first.

The obligations are becoming explicit. The Department of Defence Production issued a revised Security Manual for Licensed Defence Industries (SMLDI 2025) in July 2025, and DPIIT's Press Note 3 of 2025 requires holders of industrial licences for defence items to comply with it before commencing production. As summarised by legal commentators, SMLDI 2025 expects a dedicated CISO for companies with turnover above ₹250 crore, vetted security officers, official work on air-gapped networks, controls such as firewalls, intrusion detection, SIEM and privileged account management, policies for SCADA and industrial systems, a data classification policy, cyber awareness in induction and, for companies handling government orders, designs or products, integration of logs with the Ministry of Defence's cyber security operations centre. CERT-In's Directions of April 2022 require six-hour incident reporting and 180-day log retention, its 2025 audit policy guidelines expect risk-based independent audits including OT, the Official Secrets Act 1923 protects classified information, and suppliers to United States primes face DFARS and CMMC requirements built on NIST SP 800-171.

Figure 1: India's defence and strategic industries ecosystem.

• The Ministry of Defence sets policy through the Department of Defence Production (DDP), the Department of Military Affairs and the Department of Defence Research and Development; DDP issues the Security Manual for Licensed Defence Industries and oversees DPSUs and indigenisation.
• DPIIT issues industrial licences for defence items under the IDR Act and, through Press Note 3 of 2025, links them to SMLDI compliance; the Ministry of Home Affairs licenses arms and ammunition under the Arms Act.
• DRDO laboratories design systems and transfer technology to development and production partners; the armed forces define requirements, run trials and operate and sustain equipment.
• CERT-In and NCIIPC handle incident reporting, advisories and protected systems; IN-SPACe authorises non-government space activities; iDEX funds start-ups and MSMEs through challenges and the ADITI scheme.
• Defence PSUs and private primes integrate platforms and manage multi-tier supply chains; MSME suppliers in clusters and the Uttar Pradesh and Tamil Nadu defence corridors make parts and sub-assemblies.
• Foreign OEMs and primes partner through joint ventures, licensed production and offsets, bringing export-control and contractual security requirements such as DFARS and CMMC.

Codec Networks is a CERT-In empanelled information security auditing organisation, empanelled with NICSI for application audit and compliance services (start-up category), and certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. Its clients include ministry-level defence bodies and defence public-sector undertakings. For defence and strategic industries we deliver SMLDI 2025 cyber gap assessments, CERT-In risk-based audits covering IT and OT, tiered supplier security assessments and secure data-exchange reviews, secure development and firmware assurance for software, embedded systems and build pipelines, assessments of air-gapped and restricted environments, NIST SP 800-171 readiness for suppliers to US primes, ISO 27001 and data classification programmes, 24x7 managed SOC with threat hunting and log readiness for MoD integration, and forensics for espionage, leak, insider and ransomware incidents. Work in classified or restricted environments is carried out only by appropriately vetted staff, under the customer's security clearance procedures and on the customer's premises and systems where required.

Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, regulatory or security-clearance advice. Obligations differ by type of entity, industrial licence conditions, product category, any NCIIPC notification, programme and contract terms and the information each organisation handles; confirm them against the official Ministry of Defence, DDP, DPIIT, CERT-In, NCIIPC and Data Protection Board instruments, your licence and your contracts. Assessments of classified or restricted environments are conducted only under the customer's security clearance procedures.