The Economics of Cyber Resilience: Shifting from Technical Firewalls to Institutional Risk Management in India

Abstract

Cybersecurity has been historically viewed as a technical problem in India—i.e., firewalls, malware scanners, intrusion detection systems, etc., were thought of as the primary means of defending against cyber threats330. However, due to the rapid growth of the digital economy (driven by Aadhaar, UPI, Fintech, digitisation and all of the other records of the artificial digital economy), there has come about a need for a shift in perspective regarding Cyber Resiliency. As such, this chapter argues that cyber resiliency should not only be considered a technology-based product but as an economic and institutional necessity331.
This chapter discusses how cyber risk is viewed as an external systemic risk, i.e., a breach at one entity can create cascading impact on multiple entities across financial markets, supply chains, and critical infrastructures332. The chapter contrasts the extremely high costs for organizations due to data breaches (i.e., downtime, brand damage, regulator penalties, etc.) with comparatively lower investments made by parties to defend against such breaches (i.e., as cyber insurance, redundancy systems, and institutional governance frameworks)333 . Finally, the chapter discusses specific Cyber Resiliency challenges faced within the Indian economy (e.g., limited resources available to deal with cybersecurity risks, the fact that breaches are frequently unreported, the limited number of skilled cybersecurity professionals available) while highlighting the necessity of developing and incorporating Cyber Resiliency processes and planning into future economic and policy-making initiatives334.
As the foundation of resilience, Institutional risk management includes board-level accountability, mandatory disclosure norms, and recovery planning. The chapter evaluates regulatory frameworks such as SEBI's Cyber Security and Cyber Resilience Framework (CSCRF)335, the Reserve Bank of India's (RBI) Banking Guidelines on Cyber Security336 , and the Crisis Management Protocols developed by CERT-In337. These frameworks are also compared with global models, including the European Union's NIS2 Directive338 and the NIST Cyber Security Framework developed by the United States government339.

The chapter is clear that resilience is not just about eliminating risk; it is about providing the ability to continue, adapt, and maintain trust in India's digital economy. Ultimately, the chapter argues that India must integrate cyber resilience into its governance and financial systems to ensure a future that is digitally enabled. Cybersecurity will be considered an institutional and economic challenge—as opposed to strictly a technical challenge. In doing so, India protects its digital transformation and creates an opportunity to become a global leader in resilient digital governance.

DOI - https://doi.org/10.65525/SVUP.9788199328631.2025.151-165