Resources Categories
INDUSTRY FACT FILE · SAAS & ENTERPRISE SOFTWARE
Industry Overview: SaaS and Enterprise Software in India
Who builds the software platforms that hold customers' business data, the obligations that reach them, who buys cybersecurity and why each needs a distinct approach.
|
In this document 1. Why SaaS security matters now 2. The ecosystem at a glance 3. Categories of SaaS and enterprise software vendors 4. The obligations and expectations that reach SaaS vendors 5. Government, customer and private participants 6. Who buys cybersecurity inside a SaaS company 7. Why each product type needs a different approach 8. How Codec Networks works with SaaS vendors |
|
Sector scope Sector: SaaS and enterprise software — ERP, CRM, HRMS, collaboration, cybersecurity and business application vendors. Primary service proposition: product VAPT, SAST/DAST/SCA, API testing, tenant isolation, cloud security and SOC 2 readiness. Cloud and hosting providers and IT service firms are covered in separate fact files. |
1. Why SaaS security matters now
India is home to a fast-growing SaaS industry selling ERP, CRM, HR, collaboration and vertical applications to customers worldwide. Each multi-tenant platform holds the business data of many customers at once, so a single flaw in tenant isolation, an API or a support tool can expose them all.
|
6 hours To report cyber incidents to CERT-In |
Oct 2024 CERT-In SBOM technical guidelines issued |
Sep 2026 EU Cyber Resilience Act reporting obligations apply |
May 2027 Most DPDP obligations take effect |
Recent incidents show the pattern. In 2024, attackers used stolen credentials to access customer accounts on a major cloud data platform where MFA was not enforced; in 2023, a large identity provider's support system was breached; and in 2025, stolen OAuth tokens from a third-party chat integration were used to export data from many organisations' CRM instances.
Enterprise and regulated customers now expect SOC 2 or ISO/IEC 27001, product test reports and an SBOM. CERT-In's Directions require six-hour incident reporting, CERT-In issued SBOM guidelines in 2024, and the DPDP framework requires reasonable security safeguards for personal data.
|
Key takeaway For a SaaS company, security is a feature customers buy. Tenant isolation, integrations and support access are part of the product—and proving them wins security reviews. |
2. The ecosystem at a glance
Figure 1: India's SaaS and enterprise software ecosystem.
3. Categories of SaaS and enterprise software vendors
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
ERP vendors |
Finance, procurement, supply chain and manufacturing platforms |
Indian and global software companies |
DPDP; customer contracts; BFSI flow-down where applicable |
|
CRM vendors |
Sales, marketing and customer service platforms |
SaaS companies of all sizes |
DPDP; GDPR for EU data; customer contracts |
|
HRMS and payroll vendors |
Payroll, attendance, benefits and HR records |
SaaS companies and payroll providers |
DPDP; employment data obligations |
|
Collaboration platforms |
Messaging, documents, meetings and workflow |
SaaS companies |
DPDP; customer contracts |
|
Cybersecurity product companies |
Security platforms with privileged access to customer environments |
Product companies |
Customer contracts; high trust expectations |
|
Vertical business SaaS |
Applications for healthcare, education, finance, retail and logistics |
Start-ups and scale-ups |
Sector rules of customers; DPDP |
|
Software sold on-premise |
Licensed enterprise software and appliances |
Product companies |
Customer contracts; EU CRA for in-scope EU products |
4. The obligations and expectations that reach SaaS vendors
|
Instrument |
What it means for SaaS vendors |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India |
|
CERT-In SBOM technical guidelines (October 2024) |
Recommended practices for creating and managing software bills of materials |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits, including applications, APIs and cloud |
|
DPDP Act 2023 and DPDP Rules 2025 |
Processor safeguards for customers' data; controller duties for your own users; most obligations from May 2027 |
|
Customer regulator flow-down |
RBI, SEBI and IRDAI vendor and cloud requirements for BFSI customers; MeitY empanelment for cloud services to government |
|
SOC 2, ISO/IEC 27001, GDPR and EU CRA |
Enterprise assurance expectations; EU personal data rules; security of in-scope products with digital elements (reporting from September 2026) |
|
How these apply Many requirements reach SaaS vendors through customer contracts and product scope. Confirm the clauses in your agreements and the official instruments. |
5. Government, customer and private participants
- CERT-In sets incident reporting, logging, audit and SBOM expectations.
- MeitY oversees the DPDP framework and empanels cloud services for government use.
- Enterprise and regulated customers run security reviews and pass on their regulators' requirements.
- Cloud providers operate the infrastructure under a shared-responsibility model.
- Integration partners and marketplaces extend products—and the attack surface.
6. Who buys cybersecurity inside a SaaS company
|
Stakeholder |
What they care about |
What they buy |
|
Founder, CEO and Board |
Customer trust, growth, valuation |
SOC 2 programmes, Board reporting |
|
CTO and engineering heads |
Secure code, architecture and releases |
Code review, DevSecOps, tenant isolation testing |
|
CISO or head of security |
Production security, incidents |
VAPT, SOC, red teaming, IR retainer |
|
Product management |
Security features customers ask for |
Security requirements and testing |
|
Sales and customer success |
Security reviews and questionnaires |
Test reports, trust centre evidence |
|
Compliance and legal |
DPDP, GDPR, contracts |
Privacy programme, DPAs |
|
Platform and DevOps |
Cloud and Kubernetes security |
Cloud and IaC reviews |
7. Why each product type needs a different approach
|
Product type |
Highest-consequence risk |
Starting point for assurance |
|
ERP |
Tenant isolation and financial data integrity |
Tenant isolation testing, business-logic testing |
|
CRM |
Integration token theft and bulk exports |
OAuth and API reviews, export monitoring |
|
HRMS and payroll |
Payroll fraud and employee data exposure |
Business-logic testing, access reviews |
|
Collaboration |
Account takeover and external sharing |
Identity and sharing controls testing |
|
Cybersecurity products |
Privileged agents in customer environments |
Supply-chain and update integrity reviews |
|
Vertical SaaS |
Sector-specific data and regulations |
Product VAPT and regulatory mapping |
8. How Codec Networks works with SaaS vendors
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For SaaS vendors we deliver product VAPT, secure code review and SAST/DAST/SCA, API and tenant isolation testing, cloud security reviews, SOC 2 and ISO 27001 readiness and managed SOC.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. Customer, certification and international requirements apply through contracts and product scope. Confirm obligations against the official CERT-In, MeitY, customer-regulator and EU instruments.