Last year I visited a manufacturing plant in Pune that had done everything right. The company is working on compliance to prepare for an IPO by 2027-2028.
Two years of focused digital transformation. A vendor management portal that let 40 suppliers update their details, submit invoices, and track delivery status without a single phone call to the procurement team. An ERP system integrated with their distributor network so orders flowed in real time. IoT sensors on every major machine on the shop floor feeding live data to a cloud dashboard. A dedicated WiFi network for visitors and contractors so they could work from the premises. Three consultants with company email accounts so coordination happened fast.
The Operations Head walked me through it with genuine pride. Efficiency had improved significantly. Manual data entry had dropped. Decision-making was faster.
I asked one question when he finished.
“Who can access your vendor portal right now, from where, and does anyone review that list?”
He paused. “Our vendors. They log in when they need to.”
“What happens when a vendor’s employee leaves their company?”
Longer pause.
“We remove access when the vendor tells us.”
“When was the last time you audited whether every active login still represents someone who should be there?”
He did not know the answer. He turned to his IT head, who also did not know.
That unknown is not a technology failure. It is a governance gap. And it is the gap that sits at the centre of nearly every significant data breach in India in 2025 and 2026. Not a sophisticated zero-day attack. Not a nation-state adversary. An invitation that was extended and never reviewed.
Digital Transformation’s Most Overlooked Output: Attack Surface
India’s digital transformation story is genuinely impressive. Endpoint growth has been explosive, with over 8.44 million monitored endpoints representing just a fraction of the actual connected device estate across Indian enterprises. Manufacturing companies have deployed IoT at scale. NBFCs have built digital onboarding journeys. Banks have launched API ecosystems. Distributors and suppliers are now connected directly to ERP systems that were once sealed inside the company’s own data centre. Corbado
Every one of these connections is a business success. Every one of them is also a new door into the organisation’s data environment.
The average cost of a data breach in India reached an all-time high of approximately ₹22 crore in 2025, a 13 percent increase from the previous year. That number is not driven primarily by sophisticated attacks on hardened infrastructure. It is driven by the cumulative consequences of connections built for efficiency and governed by none. Corbado
The specific entry points that organisations create during digital transformation and then fail to secure adequately are consistent across sectors. They appear in manufacturing plants, NBFCs, insurance companies, logistics firms, and mid-size enterprises across India. And they appear in the breach reports that have filled this blog for the past year.
The Vendor Portal That Nobody Secured
The vendor management portal is one of the most common first digital transformation initiatives an Indian company builds. The business case is straightforward. Instead of procurement staff spending hours collecting supplier documents, verifying invoice details, and chasing delivery confirmations, a portal lets vendors do it themselves. Efficiency wins. Headcount freed up. Decision cycle shortened.
What the business case does not account for is what the portal represents from a security perspective: a publicly accessible URL, authenticated only by a username and password, that grants access to your supply chain data, your pricing information, your delivery schedules, and often your ERP-linked purchase order and payment data.
A malware incident targeting a third-party vendor portal associated with a major Indian private sector bank was reported in 2025. A ransomware group claimed responsibility, alleging credential harvesting through the compromised vendor access point. ecsInfotech
The credential harvesting did not require a sophisticated attack. A vendor’s employee had a weak password. Or reused a password from another platform where it had already been compromised. The bank’s portal accepted that credential, and the attacker entered as a legitimate vendor user.
The specific failures in vendor portal deployments that recur across Indian organisations are consistent.
No session timeout that forces re-authentication after inactivity. Credentials that remain active indefinitely after a vendor relationship ends or a vendor employee leaves. No multi-factor authentication requirement. No monitoring of login patterns that would flag access from unusual IP addresses at unusual hours. No restriction on what data a vendor can export once authenticated.
The portal was built for the vendor’s convenience. The security controls were an afterthought, if they were considered at all.
The ERP Integration That Crossed the Perimeter
The ERP system is the nervous system of most Indian manufacturing and trading companies. It holds pricing, inventory, customer records, financial data, production planning, and supplier relationships. For a decade, it sat behind the corporate firewall, accessible only from inside the office network.
Digital transformation changed that. Distributors needed real-time inventory visibility. Logistics partners needed to update delivery status. Finance teams at partner companies needed to reconcile purchase orders without phone calls. So ERP access was extended outward, through APIs, through dedicated portals, through site-to-site VPNs, and sometimes through direct user credentials issued to partner company staff.
Today, pressure to integrate ERP, manufacturing execution systems, and cloud analytics has punched holes in perimeters that were once clearly defined, often without compensating controls.
What lives in the ERP that is now reachable from partner networks? Pricing structures. Margin data. Customer lists. Supplier costs. Production schedules. Financial records. In the hands of a competitor or a ransomware group, this data is extraordinarily valuable. And the path to it is often a VPN credential issued to a partner company’s IT team that has never been reviewed since it was created.
When Bajaj Auto’s technology subsidiary was breached in June 2026, the attack reached production-critical systems through an IT/OT environment that had been progressively integrated in the name of digital efficiency. The factory floor and the corporate IT domain were connected. The connection enabled the attack to spread further than it otherwise could have. The IT/OT convergence that digital transformation creates is one of the most significant and least governed security consequences of the digital transformation journey.
The Email Account That Stayed Active After the Consultant Left
Consultants are a standard feature of digital transformation programmes. Implementation partners for ERP systems. Change management consultants who need to work closely with teams. Project managers from system integrators. All of them need to communicate internally, access shared documents, and collaborate with staff.
The easy answer is a company email account. It takes ten minutes to create. The consultant can start working immediately. Collaboration happens through familiar tools.
The security problem with this approach becomes visible the moment the engagement ends.
The consultant’s project wraps up. They submit their final report. The invoice is paid. And their email account, which has spent three months accumulating access to internal documents, customer data, and shared drives, remains active.
In 2026, 49 percent of employees reuse the same credentials across multiple work applications, and 36 percent use identical credentials for personal and professional accounts. A consultant working across multiple engagements, using a consistent password pattern, has almost certainly used a variation of the same password at other organisations. If that password appears in any credential database on the dark web, their company email account at your organisation is accessible to anyone with a Tor browser and a list to try.
Bank of Baroda discovered this pattern in the most direct possible way. A compromised employee email account was the entry point for what became India’s most significant banking data breach of 2026, with the bank acknowledging that the employee’s lack of digital hygiene was the cause. The email account was accessible. The credentials were insufficient. The data that flowed through that inbox over months of normal business activity was the payload. ecsInfotech
The consultant email account that nobody remembered to deactivate follows the same logic. An active credential in a former engagement’s environment, accessible to anyone who obtains it, containing months of internal communication and document access history.
The IoT Sensors With Ports Nobody Closed
IoT deployment in Indian manufacturing has accelerated dramatically. Temperature sensors on production equipment. Energy monitoring systems on factory floors. CCTV cameras connected to cloud storage. Attendance systems linked to HR software. Air quality monitors feeding safety dashboards. Each of these is a genuine operational improvement.
Each of them is also a networked device, often running firmware that ships with default credentials, often connected directly to the internet for cloud data transmission, and often forgotten about from a security perspective the moment installation is complete.
The rise of IoT devices in manufacturing and logistics specifically widened the attack gap in 2025, with each connected device representing a potential entry point for attackers. Corbado
The specific problem with most IoT deployments in Indian organisations is port governance. A temperature sensor that transmits data to a cloud dashboard needs outbound connectivity on specific ports. The firewall rule that was added during installation often opens those ports broadly rather than specifically, because the implementation team was focused on making the device work, not on limiting its reach. That same port configuration, six months later, may have expanded to allow inbound connections that the original use case never required.
Neither IT teams nor OT teams fully own the boundary between connected factory systems and corporate networks, and that boundary is exactly where attackers pivot.
The IoT device that nobody manages after installation is the one whose firmware has not been updated in two years, whose default admin credentials were never changed, and whose open ports represent a direct path from the internet to the corporate network.
The Open WiFi That Became the Entry Door
The conference room WiFi network is a genuine operational convenience. Visitors can connect. Contractors can work. Delivery teams can submit documentation. Nobody needs to call IT for a guest password.
The security problem with open WiFi in most Indian office and factory environments is segmentation. Or rather, the absence of it.
A visitor connected to the guest WiFi should have internet access and nothing else. They should be on a network that is completely isolated from the corporate LAN, the ERP server, the file storage, and every other internal system. In most deployments, this segmentation either does not exist or has been compromised over time.
Someone in IT needed to access a printer from the guest network, so they added a route. A contractor who regularly works on site needed to reach the ERP for project work, so their device was added to the main network. The guest WiFi password was shared in a WhatsApp group and has not been changed in eighteen months.
The device that an attacker needs to gain network access is not always their own. It is sometimes a legitimate visitor’s laptop, infected with malware before arrival, that simply needs to connect to WiFi to begin scanning internal systems. Open WiFi without network segmentation means that the scan reaches everything.
The Cloud Apps Nobody in IT Approved
Shadow IT is not new. What digital transformation has done is accelerate it to the point where the gap between what IT knows about and what the organisation is actually using is wider than it has ever been.
A marketing team signs up for a SaaS platform that uses customer email data for campaign automation. A finance team begins using a cloud spreadsheet tool where they store pricing and margin data. A project team starts using a collaboration platform where product specifications and technical drawings are shared with external partners.
None of these are inherently wrong. All of them bypass the data governance review that would determine whether the platform is appropriate for the data being stored, what the vendor’s security posture is, and whether the data flows are compliant with applicable regulations, including the DPDP Act.
Shadow APIs, undocumented or unmanaged API endpoints created by these platforms, are especially dangerous, creating blind spots for attackers to exploit. Indian businesses are increasingly experiencing breaches through unauthorised API access and data leaks. Mitigata
Angel One’s 2025 breach exposed sensitive data for nearly 8 million users through unauthorized access to its cloud-hosted resources. Cloud environments that are not inventoried, monitored, and access-controlled carry the same risk as unmanaged on-premises infrastructure. The cloud does not inherently make data safer. It makes data more accessible, which is precisely what attackers look for. P J Networks LLC
The Parts of the Network Nobody Looked at During DT
Every organisation that has gone through a significant digital transformation programme has parts of its IT environment that were explicitly in scope, parts that were touched along the way, and parts that were simply not included.
Legacy systems still running on outdated operating systems because the DT programme only covered new implementations. Network segments from a previous office layout that were never decommissioned. Printer servers and shared drives from five years ago that still have open network access. Backup systems that have not been tested since the DT programme began because the focus was on the new environment, not the old one.
The CDSL adjudication order that SEBI issued in July 2026 is the clearest regulatory statement of what this looks like when it becomes a breach. The ADFS server, which was internet-facing, was not classified as a critical asset. It was excluded from VAPT. An admin account created in 2021 had a password set to never expire. And the disaster recovery site was already infected when failover was attempted. None of these were hidden risks. They were known configurations that accumulated in the environment while the organisation’s attention was on other priorities. MEDIANAMA
SEBI called the resulting ransomware attack a foreseeable outcome. The malware attack was a foreseeable outcome of lapses built up over time, including unwarranted policy deviations, unimplemented regulatory directions, and the absence of certain cybersecurity measures. MEDIANAMA
The parts of the network nobody looked at during digital transformation are the parts that make the next breach foreseeable.
What Digital Transformation With Security Embedded Looks Like
This blog is not an argument against digital transformation. It is an argument for a specific discipline that most Indian organisations skip during their DT programmes: treating every new connection, every new access grant, and every new device as a security decision, not just a business decision.
A vendor portal that is launched with its security architecture designed alongside its business architecture looks different from one launched as a convenience. User access is time-limited and tied to active vendor relationships. Sessions expire. Login anomalies generate alerts. Export volumes are monitored. The vendor credential list is audited quarterly.
An ERP integration with a partner organisation is built with least-privilege access. The partner can see what they need. They cannot reach what they do not. Their access is reviewed when the relationship changes. It expires when the engagement ends.
Every IoT device added to the network is registered, assigned to a named network segment, configured with non-default credentials, and included in the firmware update schedule. The ports it requires are opened specifically and reviewed after installation.
The consultant email account is created with a defined end date. When that date arrives, the account is automatically deactivated. The documents the consultant accessed are reviewed to ensure nothing sensitive was retained in personal storage.
The guest WiFi is on a completely isolated segment with no path to internal systems. Devices that connect to it are not on the same network as the ERP, the file server, or any production system.
Every one of these is an operational decision that costs very little to get right at the start and a great deal to fix after a breach.
EasyNAC provides the network-level visibility that makes this governance possible. When every device that connects to the network is identified the moment it connects, assigned to a network segment based on its type and authorisation level, and monitored for anomalous behaviour, the unknown devices and unreviewed connections that enable most breaches become visible. Not after the breach. At the moment of connection.
For the human side of the access problem, consultant accounts, vendor credentials, employee access that outlives the employment relationship, OfficeSIA manages the lifecycle of access alongside the lifecycle of the relationship. When the consultant’s engagement ends, the account ends. When the vendor relationship closes, the credential closes. The connection between the human relationship and the digital access is automatic rather than dependent on someone remembering to send an IT ticket.
Final Thought
The COO I visited in Pune was not careless. He had built something genuinely impressive and genuinely useful for his business. The vendor portal had eliminated hours of procurement overhead. The IoT dashboard had improved maintenance scheduling. The ERP integration had shortened the order fulfilment cycle.
What he had not built was the security architecture that governed all of those connections.
Digital transformation generates data. The companies that get this right generate that data in an environment where they know what is connected, who has access, what those connections can reach, and who is watching.
The companies that get it wrong generate the same data in an environment where an attacker who obtains a single vendor credential, or finds an IoT device with a default password, or connects to an open WiFi network, has a path to everything.
The transformation is identical. The governance is the difference.
The question for every COO, CTO, and IT head reading this is not whether your digital transformation is working. It almost certainly is.
The question is whether you know exactly who else is connected to it right now.
At Skeletos IT Services, we help Indian manufacturers, NBFCs, and financial institutions build digital transformation programmes with security architecture embedded from day one. From network access control that identifies every device the moment it connects, to employee and consultant lifecycle management that ensures access ends when relationships do, we build the governance layer that makes digital transformation sustainable. If you want to understand what your current DT environment is actually exposing, we can help you find out.
Note: This blog references incidents from verified public sources. Specific incidents mentioned are linked to their detailed analysis in earlier Skeletos blog posts. Statistics are sourced from Mitigata India Cyber Threat Report 2025 and AGBE India enterprise breach analysis 2026. This blog is for awareness and educational purposes.
