Resources Categories
INDUSTRY FACT FILE · PROFESSIONAL & BUSINESS SERVICES
Market Landscape and the Drivers of Cybersecurity Demand in Professional Services
The business, technology, regulatory, legal and statutory forces that create cybersecurity, privacy, audit and assurance work for law, accounting, consulting, recruitment, staffing, payroll and shared-services firms.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: CERT-In, DPDP, professional bodies, RBI and SEBI 5. Legal and statutory drivers 6. How the drivers differ by firm type 7. What this means for buyers and for Codec Networks |
1. Market landscape
India's professional and business services sector is large, fragmented and increasingly global. More than four lakh chartered accountants are members of ICAI; law firms range from sole practitioners to full-service firms with hundreds of lawyers, and the Bar Council of India has opened a reciprocal route for foreign lawyers and firms on non-litigious work since 2023; consultancies include the Indian arms of global networks and fast-growing domestic firms; staffing and payroll providers employ or pay large contract workforces; and business support ranges from BPO companies to the more than 1,700 global capability centres counted by Nasscom and Zinnov in FY24, employing over 1.9 million people. Much of the sector serves banks, insurers, listed companies and multinationals, so its security standards are increasingly set by its clients.
Cybersecurity demand follows four pressures. Fraud: business email compromise drew about US$3.05 billion of losses reported to the FBI in 2025, up from about US$2.77 billion in 2024, and professional firms sit in the middle of the payments it targets. Trust: clients leave firms whose files appear on leak sites or whose payroll platforms expose their staff, as the Capita, Zellis and Infosys McCamish incidents showed. Compliance: CERT-In reporting and audits, DPDP fiduciary and processor duties, professional confidentiality and the labour codes all require evidence. Client assurance: RBI-regulated, SEBI-regulated and global clients ask for SOC 2, ISO/IEC 27001, questionnaires and audit rights before awarding or renewing mandates. Spending is moving from basic antivirus and firewalls to identity and email security, data protection, privacy programmes, client-assurance certifications and managed monitoring.
|
1,700+ Global capability centres in India (Nasscom-Zinnov, FY24) |
1.9m+ People employed by India's GCCs (FY24) |
4 lakh+ Members of ICAI, India's accounting body |
May 2027 Most DPDP obligations, incl. safeguards, take effect |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Law firms and legal services |
Partnership culture, partner-led IT decisions, cloud migration, global clients and foreign-firm entry |
Email and identity hardening, DMS access reviews, BEC response, ISO 27001 |
|
CA, audit and tax firms |
Network member firms and thousands of smaller practices; seasonal peaks; client ERP access |
Remote-access and ransomware readiness, DLP, client evidence, SOC |
|
Consulting firms |
Project-based teams, heavy use of client data and AI tools, frequent lateral moves |
Data classification, AI governance, leaver controls, monitoring |
|
Recruitment and staffing |
Listed staffing majors, many smaller agencies, large candidate databases |
ATS and cloud testing, DPDP programme, brand monitoring |
|
Payroll and HR outsourcing |
SaaS and service providers paying staff for many employers; labour-code change |
Application and file-transfer testing, vendor risk, processor contracts |
|
Business support, BPO and GCCs |
Captive and third-party centres running processes for regulated clients |
SOC 2, ISO 27001, PAM, help-desk controls, managed SOC |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Protecting client trust |
A single leak or diverted payment can end a client relationship |
Email security, DLP, SOC, incident response |
|
Winning regulated clients |
Banks, insurers and listed companies audit their advisers and vendors |
ISO 27001 and SOC 2 readiness, VAPT reports, evidence packs |
|
Stopping payment fraud |
BEC targets client funds, fees, payroll and vendor payments |
BEC defences, call-back controls, fraud investigations |
|
Professional liability and insurance |
Insurers ask about MFA, backups and monitoring before cover |
Assessments, backup testing, SOC |
|
Protecting people data |
Staffing, payroll and recruitment firms hold data for lakhs of people |
DPDP programmes, encryption, platform testing |
|
Partner and talent mobility |
Lateral moves and departures put client files at risk |
Leaver controls, DLP, insider investigations |
|
Growth, mergers and network membership |
Firm mergers and global network standards require security baselines |
Due diligence, integration security, GRC programmes |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Cloud email and collaboration |
Mailbox takeover, token theft, hidden forwarding rules |
Tenant review, phishing-resistant MFA, SOC monitoring |
|
Document management and data rooms |
Broad access and external sharing of confidential files |
Access reviews, link controls, DLP |
|
Client portals and file transfer |
Internet-facing tools exploited at scale |
Portal and API testing, exposure monitoring, patching |
|
Payroll, HRMS and ATS platforms |
Concentrated people data across many employers |
Application testing, encryption, vendor risk |
|
Remote and hybrid work |
VPNs, personal devices and home networks |
Remote-access assessment, device management, zero trust |
|
Generative AI tools |
Client data pasted into public models; AI-generated lures |
AI usage policy, data controls, AI risk review |
Figure 3: The four groups of drivers behind cybersecurity spending in professional and business services.
4. Regulatory drivers: CERT-In, DPDP, professional bodies, RBI and SEBI
|
Instrument |
Key requirements |
|
CERT-In Directions (2022) and audit guidelines (2025) |
Six-hour incident reporting; 180-day ICT logs; risk-based independent audits covering infrastructure, cloud and applications |
|
DPDP Act 2023 and Rules 2025 |
Fiduciary duties for staff, partner and candidate data; processing of client data only under valid contracts; reasonable security safeguards and breach intimation; most obligations from May 2027 |
|
Chartered Accountants Act 1949, ICAI Code of Ethics and NFRA |
Confidentiality of client information as a professional duty; audit documentation and quality expectations for specified audits |
|
Advocates Act, BCI rules and BSA 2023 Section 132 |
Protection of advocate-client communications; BCI rules on foreign lawyers and law firms notified in March 2023 and amended in May 2025 |
|
RBI IT outsourcing directions (2023) and SEBI CSCRF (2024) |
Service-provider risk management, controls and audit rights for vendors to regulated entities; cyber resilience expectations for SEBI-regulated entities including registrars and share transfer agents |
|
SEBI LODR Regulations (listed companies) |
Quarterly disclosure of cyber incidents in the corporate governance report by listed firms and listed clients |
|
Confirm applicability Obligations depend on the profession, registrations, client base, contracts and listing status. Many requirements arrive through client agreements rather than directly from a regulator. Confirm against the official instruments and your contracts. |
Figure 4: Regulatory and policy timeline shaping professional services cybersecurity, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
IT Act, 2000 and CERT-In Directions |
Incident reporting, logging and offences against computer systems |
SOC, logging, audits and incident response |
|
DPDP Act, 2023 and Rules, 2025 |
Personal data of clients' staff, candidates, employees and partners |
Privacy programmes, processor contracts, safeguards |
|
Chartered Accountants Act, 1949 |
Professional misconduct for unauthorised disclosure of client information |
Access control, DLP, confidentiality policies |
|
Bharatiya Sakshya Adhiniyam, 2023 |
Privilege for professional communications with advocates |
Protection of privileged files and email |
|
Indian Contract Act, 1872 and client agreements |
NDAs, security schedules, audit rights and liability caps |
Client assurance, evidence packs, audits |
|
Labour codes, 2019–2020 (in force 2025) |
Wage, social security and records obligations for employers and staffing firms |
Payroll platform security, data migration reviews |
|
Companies Act, 2013 and SEBI LODR |
Board risk responsibility; disclosure for listed entities |
Board reporting, incident records |
6. How the drivers differ by firm type
|
Firm type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Law firms |
Client trust, privilege, payments |
Cloud email, DMS, data rooms |
BCI rules, BSA s.132, DPDP, CERT-In |
|
CA and audit firms |
Audit quality, client confidence |
Audit software, client ERP access |
CA Act, ICAI ethics, NFRA, DPDP |
|
Consulting firms |
Deal confidentiality, client renewal |
Collaboration, analytics, AI |
Client contracts, DPDP, insider-trading rules |
|
Recruitment and staffing |
Candidate trust, client mandates |
ATS, job boards, cloud storage |
DPDP, labour codes, SEBI LODR if listed |
|
Payroll and HR outsourcing |
Employer trust, accuracy |
Payroll engines, file transfer |
DPDP as processor, labour codes, CERT-In |
|
Business support and GCCs |
Contract renewal, client audits |
Client ERPs, help desks, PAM |
RBI IT outsourcing, SEBI CSCRF, contracts |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“A client almost paid a fraudster who copied our partner's email.” |
BEC assessment, Microsoft 365 hardening and call-back controls |
SOC monitoring of mailboxes and annual awareness |
|
“Our biggest bank client wants a SOC 2 report.” |
SOC 2 or ISO 27001 readiness with gap remediation |
Annual audit support and continuous evidence |
|
“Are we a fiduciary or a processor under DPDP?” |
DPDP gap assessment with data map and contract review |
DPO-as-a-Service and annual privacy review |
|
“Our payroll platform holds data for 200 employers.” |
Application, API and file-transfer testing with encryption review |
Quarterly testing and vendor monitoring |
|
“A senior partner left and took client files.” |
Insider investigation and leaver-control review |
DLP and monitoring of bulk downloads |
|
“Fake recruiters are using our brand.” |
Brand monitoring and takedown support |
Continuous monitoring and candidate awareness |
|
“Our VPN and remote access have never been tested.” |
External and remote-access assessment |
Annual VAPT and managed SOC |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal or regulatory advice. Obligations differ by professional registration, client base, contracts, listing status and the data each firm handles; confirm them against the official CERT-In, MeitY, ICAI, Bar Council of India, RBI, SEBI and Ministry of Labour and Employment instruments and your own agreements.