India will see 1.5 mn vacancies in cybersecurity in 2025: Microsoft's Gomes

India is one of the fastest-growing security markets for the company, said Terence Gomes, country head, security, Microsoft India

Microsoft in its recent quarterly report said its security business brings in $20 billion in annual revenue -- double the 2021 figure, and up from $15 billion in 2022. Terence Gomes, country head, security, Microsoft India, tells Shivani Shinde in an interview that India is one of the fastest-growing security markets for the company, adding that the digital explosion of the last three years has also created more attack entry points. Edited excerpts:

Where does India fit into the $20-billion milestone of Microsoft’s security business?

The $20-billion milestone of the security business is important globally as well as for India. In the context of India it’s more in terms of two times growth in customer segment over the last two years. We are adding customers on a rapid scale and have seen significant positive momentum.

When working with the government sector, we picked three themes: Enable India, partner with India, and protect India. With the public sector we focus on securing and enabling them through cyber-scaling initiatives. One such initiative is Cyber Surakshit Bharat in the public sector space, where we train hundreds of CSOs and help to improve their public posture. We also share threat intelligence with the government of India. We analyse more than 65 trillion signals. More than 8,500 experts and data scientists across 77 countries provide a unique view of the threat landscape.

The other thing we see in India is that security is now front-and-centre, and is becoming a boardroom conversation. CERT-In in its recent report says 1.2 million incidents were reported in 2022, compared with 47,000 back in 2017. There is a rapid increase in attack- and incident- tracking. The scale and volume are constantly increasing.

How big is the opportunity in India, and what investments have been made?

India is one of the fastest-growing markets for us, and security as a business is one of the fastest-growing businesses for India. The success we are getting and the clients working with us show huge momentum here.

Globally, we invest $1 billion annually in security and we recently also said that $20 billion will be invested over a period of five years. The focus is on building capabilities around security, both in the Microsoft platform Azure and Microsoft 365, but also in products for third-party platforms.

Also, cybersecurity has become a business problem rather than just a technical problem. With a lot of business uptime and brand reputation at stake, there is a shareholder accountability aspect related to security, and hence it is getting prioritised. We are seeing that these technologies, ransomware and phishing attacks are going up. Budgets too are going up.

What is making businesses in India choose Microsoft?

It’s the digital explosion of the last three years, and also, the attack surface has gone up. This digital explosion has created, first, a significant risk. Second, attackers are becoming more sophisticated, and ransomware has gone up in the last two years. Third, and most important, the market is very fragmented. Our approach is to do security holistically and we are providing end-to-end protection, and our focus is to simplify the process.

Rather than work with 50 different vendors and categories, we are making it all built-in within one platform and it’s a very compelling proposition. This also brings a lot of savings for companies. We did a study recently which showed that clients see almost 60 per cent cost savings when they migrate to the Microsoft security platform, versus working with various third- party vendors.

Additionally, security is going to be multi-dimensional in India. Cloud security is one of the key parameters. But there will be on-premise, multiple clouds and multi-platforms. Our entire capability building and all our investments and road map are focused on creating a heterogeneous end-to-end security platform.

To give you an instance of the speed and agility of our security offerings, Since July 2022, Microsoft Security has delivered more than 300 product innovations -- from minor updates to major launches like Microsoft Entra Workload Identities (November 2022).

One of the concerns has been cyber skill. How does Microsoft see it?

Cyber skilling has been a concern globally and locally. One report says that India is expected to see 1.5 million vacancies in the cybersecurity space by 2025. The skilling gap is a serious issue. We do partner with the government on skilling, but we as a company also have several skilling programmes, and we work closely with the partner ecosystem. One focus of skilling is also bringing in diversity and getting more women skilled in cyber as well.

What are some of the trends you see for 2023 for India?

Ransomware continues to be the number one activity that we are seeing through our own threat telemetry. Phishing is also going up -- we detect and block more than 700 million phishing attacks on a weekly basis. We also see a lot of password attacks. The last number reported was 921 password attacks detected by Microsoft per second. Identity, phishing and ransomware continue to rise. Our recommendation is to maintain security hygiene, and having a multifactor authentication can significantly reduce the risk of a compromise.

On nation-state security threats, where is India and how prepared is India?

In our recent threat intelligence report, we dedicated a chapter on nation-state security threats. India figures in the top three countries targeted. According to the report, nation-state groups’ cyber targeting spanned the globe this past year, with a particularly heavy focus on the US and British enterprises.

Organisations in Israel, the UAE, Canada, Germany, India, Switzerland, and Japan were also among some of the most frequently targeted, according to our NSN data. We also saw a sharp uptick in DDoS (Distributed Denial of Service) attacks against India, from just 2 per cent of all attacks in the second half of 2021, to 23 per cent in the first half of 2022.