Zscaler Guide Outlines Zero Trust Defenses for India's AI and Critical Infrastructure
Report discovered via Awesome Annual Security Reports.
Summary
Zscaler's February 2026 guide recommends least-privilege access, continuous verification, data-loss controls and restricted vendor connectivity to protect India's AI systems and critical infrastructure.
Key points
- The guide recommends identifying mission-critical applications, citizen data and operational systems first, then prioritizing controls around those assets.
- Its proposed architecture grants identity- and context-based access to individual applications rather than broad network access, aiming to restrict lateral movement after compromise.
- For employee AI use, it recommends discovering tools, enforcing access policies and inspecting prompts, files and responses for sensitive information.
- Data protection recommendations cover cloud-data discovery and classification, misconfiguration remediation, endpoint controls and restrictions on unmanaged devices.
- For operational technology, the guide recommends limiting vendors to authorized machines or applications for specific tasks and time periods, without granting network-level access.
- The guide links least privilege, continuous monitoring and breach containment to implementing security safeguards under India's Digital Personal Data Protection Act.
Article Details
- Defense Focus
- Apply Zero Trust and AI-assisted monitoring to protect India's critical infrastructure, contain compromised identities and devices, prevent sensitive-data loss, and govern public and private AI use.
- Detection Methods
- Analyze user, application, and device behavior in real time for unusual login times, unexpected data flows, abnormal requests, and unusual financial transactions.
- Continuously evaluate identity, device posture, behavior, and risk context for each access request.
- Discover unauthorized AI application usage and inspect prompts, responses, and uploaded files for sensitive data or harmful content.
- Discover and classify sensitive information in cloud repositories and identify misconfigurations, vulnerabilities, and policy violations.
- Inspect outbound IoT/OT communications for unauthorized data flows and incoming malicious instructions.
- Use OT deception decoys to detect threats without operational impact.
- Apply AI-assisted classification to identify personal data, financial records, and intellectual property for data-loss prevention.
- Data Sources
- User-to-application access requests and access logs
- User identity, device health, posture, and behavioral signals
- Network traffic and application usage patterns
- AI prompts, responses, and file uploads
- Cloud databases, storage buckets, and repository configurations
- Endpoint data transfers involving USB drives, printing, and network shares
- IoT/OT outbound communications
- Public ransomware leak sites, ransomware samples, proprietary threat intelligence, attack data, and security-platform telemetry
- Defensive Actions
- Identify mission-critical applications, sensitive data, and operational assets, and prioritize their protection.
- Replace broad network access with least-privilege, application-specific access and continuous authentication and authorization.
- Use outbound-only connections to private resources to reduce public exposure.
- Restrict third-party OT access to the exact machine or application needed, for a specific task and limited duration.
- Segment IT from OT and isolate operational systems to contain lateral movement and compromised assets.
- Inspect data in motion and enforce granular policies against unauthorized sharing and exfiltration.
- Remediate cloud configuration weaknesses and sensitive-data access policy violations.
- Approve AI applications explicitly, detect shadow AI, and enforce real-time controls on prompts, responses, and content uploads.
- Preserve role-based data boundaries in private LLMs and deploy input and output guardrails.
- Validate AI-generated code and retain experienced human oversight of AI decisions and automated threat responses.
- Maintain accurate access logs to support accountability and breach response.
MITRE ATT&CK
T1078 · Valid AccountsIn the Colonial Pipeline example, attackers used stolen user login credentials to gain access to systems and a high-value billing application.T1195.002 · Compromise Software Supply ChainThe report describes attackers taking control of MeDoc's software update mechanism, with a routine update subsequently compromising Maersk.T1486 · Data Encrypted for ImpactThe report states that Colonial Pipeline attackers encrypted billing application data and demanded ransom.T1566.002 · Spearphishing LinkAPT36 sent SMS/WhatsApp phishing lures containing a link that redirected targets to deceptive government-themed login pages.T1583.001 · DomainsAPT36 reportedly registered multiple new domains hosting pages masquerading as the official Kavach app download portal.T1608.005 · Link TargetAPT36 abused Google Ads paid search to promote malicious Kavach-themed domains to the top of search results for users in India.
People
Dr. GK GoswamiContributed a section explaining how least-privilege access, continuous authentication, and micro-segmentation operationalize DPDP obligations.Jay ChaudhryZscaler Founder, Chairman, and CEO; contributor and foreword author advocating Zero Trust for India's digital infrastructure.Lt. General (Dr.) Rajesh PantContributor who served as India's National Cyber Security Coordinator between 2019 and 2023.Sandeep K ShuklaDirector IIIT Hyderabad cited on the evolution from protecting data to defending systemic digital infrastructure, including the power grid.Sanjit GanguliContributor and Zscaler CTO-in-Residence specializing in Zero Trust strategy and network transformation.Vishal GautamContributor and Director of Zscaler AI & Cyber Threat Research Center - India.
Threat Actors
APT36Identified as a Pakistan-based group also called Transparent Tribe; reportedly targeted Indian government and defence organizations through phishing, deceptive download portals, and data theft.Salt TyphoonThe report attributes a years-long campaign against US telecoms companies to this Chinese nation-state hacking group.SPIRE CASTLECloudSEK reportedly identified this China Nexus group as targeting Manufacturing through supply-chain compromises to establish persistent access to OT environments.Transparent TribeExplicitly identified as another name for APT36, the Pakistan-based group targeting Indian government and defence organizations.
Malware
Akira- **Ransomware groups are evolving fast**: Established families like RansomHub, Clop, and Akira remained dominant, while 34 new groups emerged as identified by ThreatLabz, including rebrands or offshoots of defunctClop- **Ransomware groups are evolving fast**: Established families like RansomHub, Clop, and Akira remained dominant, while 34 new groups emerged as identified by ThreatLabz, including rebrands or offshoots of defunctGafgytMozi, and Gafgyt account for ~75% of malicious IoT payloads,Mirai− Botnets and edge-device exploitation remain dominant. Mirai,MoziMozi, and Gafgyt account for ~75% of malicious IoT payloads,RansomHub- **Ransomware groups are evolving fast**: Established families like RansomHub, Clop, and Akira remained dominant, while 34 new groups emerged as identified by ThreatLabz, including rebrands or offshoots of defunct
Vendors
Products
Zero Trust Branch| VPNs with Zero Trust | systems to prevent lateral | | Zero Trust Branch | |Zscaler CellularReduce or replace Microsegment OT With Zscaler Cellular and operational impactZscaler Zero Trust Exchangeproprietary threat intelligence, ransomware samples, attack data, and telemetry from the Zscaler Zero Trust Exchange.
Countries
ChinaCloudSEK reported APT41 (China Nexus) is heavily focused on the ManufacturingIndia# Securing Digital India Against AI & Cyber Threats: Leveraging AI Security & Zero TrustNorth KoreaGenAI-enhanced malware and social engineering in North KoreaPakistanAPT36 (Transparent Tribe), a Pakistan-based advanced persistent threat group,United StatesWith experience spanning across India and the United States, he has contributed significantly to scaling Zscaler’s engineering capabilities and establishing India as a core hub for innovation and product development.
Industries
Banking and financial services- [Critical Sector: Banking and Financial Services](#critical-sector-banking-and-financial-services)Defence- [Defence and National Security Systems by Lt General Rajesh Pant](#defence-and-national-security-systems-by-lt-general-rajesh-pant)Government- [Critical Sector: Government - The Foundational Layer](#critical-sector-government---the-foundational-layer)Healthcare- **Critical industries continue to be prime targets**: Manufacturing, Technology, and Healthcare experienced the highest number of ransomware attacks, while sectors like Oil & Gas (+935%) and Government (+235%) sawManufacturing- [Critical Sectors: Manufacturing and Strategic Enterprise](#critical-sectors-manufacturing-and-strategic-enterprise)Oil and gasTechnology, and Healthcare experienced the highest number of ransomware attacks, while sectors like Oil & Gas (+935%) and Government (+235%) saw notable year-over-year spikes.Power & Energy- [Critical Sector: Power & Energy](#critical-sector-power--energy)Technology> Cybersecurity at national scale cannot be achieved by technology teams alone.TelecommunicationsAt the same time, India’s Critical Information Infrastructure (CII) spanning power, telecom, banking, transport, oil and gas, space, defence, and government systems has grown deeply interconnected and increasinglyTransportationbackdoors—to be able to disrupt or destroy vital services like power, water, communications, or transportation, at a moment of their choosing, for strategic or geopolitical advantage.