Resources Categories
INDUSTRY FACT FILE · ASSET MANAGEMENT
Market Landscape and the Drivers of Cybersecurity Demand in Asset Management
The business, technology, regulatory, legal and statutory forces that create cybersecurity, audit and assurance work for asset and investment managers.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers 5. Legal and statutory drivers 6. How the drivers differ by manager type 7. What this means for buyers and for Codec Networks |
1. Market landscape
Asset management in India is growing on the back of retail SIP flows and digital distribution, while PMS and AIF assets are expanding among affluent and institutional investors. Regulation has moved from scattered cybersecurity circulars to SEBI's consolidated CSCRF, alongside long-standing system audit requirements for mutual funds.
|
₹82.22 lakh cr MF industry AUM (AMFI, June 2026) |
27.86 cr MF folios (June 2026) |
5 CSCRF regulated-entity categories |
CERT-In Empanelled auditors required for CSCRF audits and VAPT |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Large AMCs |
Large investor bases, many channels, Qualified RE obligations |
Frequent audits and VAPT, SOC, red teaming, third-party assurance |
|
Mid-sized and new AMCs |
Rapid growth, lean teams, platform-led distribution |
CSCRF audits, managed SOC, app and API testing |
|
PMS and AIF managers |
High-value clients, small teams, sensitive deal data |
Baseline controls, BEC protection, data protection, M-SOC readiness |
|
Investment advisers and platforms |
Digital-first, partner-dependent |
App security, brand monitoring, privacy programmes |
|
Fund service providers |
Serve many funds that must assess them |
System audits, integrity controls, client assurance |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Investor trust |
Redemption fraud, data leaks or impersonation scams |
Fraud controls, app testing, brand monitoring |
|
Regulatory compliance |
CSCRF audit cycle, system audits, SEBI inspections |
CSCRF audits, VAPT, system audits |
|
Trustee and Board oversight |
Trustees require assurance on technology risk |
Board and trustee reporting, maturity assessments |
|
Distribution growth |
New partners and platforms |
Partner API testing and assurance |
|
Institutional due diligence |
Global investors and LPs ask about cyber controls |
Assurance packs, ISO 27001 |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Investor apps and portals |
Account takeover, redemption fraud |
App and transaction-flow testing |
|
Partner APIs |
Data exposure and unauthorised transactions |
API security testing |
|
Cloud adoption |
Misconfiguration and governance gaps |
SEBI cloud framework assessments |
|
Fund accounting automation |
Data integrity and feed compromise |
Integrity and vendor reviews |
|
AI tools |
Data leakage and model misuse |
AI security testing and governance |
Figure 3: The four groups of drivers behind cybersecurity spending in asset management.
4. Regulatory drivers
|
Instrument |
Applies to |
Key cybersecurity relevance |
|
SEBI Cybersecurity and Cyber Resilience Framework (20 August 2024) |
AMCs, portfolio managers, AIF managers and other specified REs |
Five categories; AMCs categorised by AUM, PMs and AIF managers by their own thresholds Cyber audits and VAPT by CERT-In empanelled auditors; SOC or Market SOC onboarding by category Cyber incidents reported to SEBI within six hours; compliance by 31 August 2025 |
|
CSCRF revisions (30 April 2025) and technical clarifications (August 2025) |
SEBI regulated entities |
Revised thresholds; AIF and VCF obligations assessed at manager level; technical clarifications on controls |
|
SEBI system audit framework for mutual funds and AMCs (2019) |
Mutual funds and AMCs |
Periodic system and process audits covering interfaces, NAV systems, access and reporting controls |
|
SEBI framework for adoption of cloud services (6 March 2023) |
SEBI regulated entities using cloud |
Governance, shared responsibility, data security, vendor risk and exit readiness |
|
SEBI insider trading and front-running provisions |
AMCs, dealers and employees |
Controls over price-sensitive information and dealing activity |
|
SEBI KYC and KRA requirements |
Intermediaries |
Secure handling of investor KYC data |
Figure 4: Regulatory timeline for asset management cybersecurity, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
SEBI Act, 1992 and SEBI regulations for MFs, PMS, AIFs and IAs |
Basis for SEBI regulation of managers |
Regulatory audits and supervisory responses |
|
IT Act, 2000 and CERT-In Directions (28 April 2022) |
6-hour reporting; ICT logs for 180 days in India |
Logging, incident readiness, SOC |
|
DPDP Act, 2023 and Rules, 2025 |
Investor personal data; most obligations from May 2027 |
Data mapping, safeguards, breach workflows |
|
Prevention of Money Laundering Act, 2002 |
Reporting-entity obligations |
KYC and transaction monitoring reviews |
|
Investor data is everywhere Investor personal data flows between AMCs, RTAs, KRAs, distributors, platforms and fund accountants. DPDP readiness therefore requires mapping data across partners, not just inside the AMC. |
6. How the drivers differ by manager type
|
Manager type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
AMCs |
Investor trust, distribution growth |
Apps, APIs, RTA systems |
CSCRF, MF system audits, cloud framework |
|
Portfolio managers |
Client trust, performance |
Reporting portals, email |
CSCRF, PMS Regulations |
|
AIF managers |
LP trust, deal confidentiality |
Data rooms, email |
CSCRF (manager level), AIF Regulations |
|
Investment advisers |
Client trust, brand |
Apps, messaging |
IA Regulations, CERT-In, DPDP |
|
Wealth platforms |
Growth, conversion |
Apps, APIs, cloud |
Partner and registration requirements, DPDP |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“We need a CSCRF cyber audit and VAPT.” |
CERT-In empanelled audit and VAPT |
Audit cycle by category |
|
“Our system audit is due.” |
MF system audit |
Periodic system audits and closure |
|
“We need SOC coverage.” |
Managed SOC or M-SOC readiness |
Monitoring and efficacy reporting |
|
“We are moving to the cloud.” |
SEBI cloud framework assessment |
Continuous cloud assurance |
|
“We must protect investor data across partners.” |
DPDPA and third-party programme |
Periodic reviews and partner assessments |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document summarises regulatory and legal instruments as published up to October 2026. It is not legal advice. Confirm obligations against current SEBI circulars, clarifications and FAQs.