Zscaler’s 2026 Report Outlines Zero Trust Defenses for India’s AI and Cyber Risks
Summary
Zscaler’s February 2026 report examines AI, ransomware, and IoT/OT risks to India’s digital infrastructure, recommending least-privilege access, continuous verification, data protection, and tighter third-party controls.
Key points
- The report recommends prioritizing mission-critical applications, citizen data, intellectual property, and operational systems before expanding security transformation.
- Citing ThreatLabz research covering April 2024–April 2025, it reports a 145.9% increase in ransomware attacks and a 70.1% rise in public extortion cases year over year.
- Its AI security guidance includes discovering employee AI usage, restricting tool access, and inspecting prompts and responses for sensitive data.
- For IoT/OT environments, it recommends application-specific, time-limited vendor access and segmentation to reduce exposure and lateral movement.
- Citing Zscaler’s 2025 Mobile, IoT & OT Threat Report, it highlights a 459% year-over-year increase in IoT attacks against energy, utilities, and oil and gas.
- The publication connects least privilege, continuous monitoring, and breach containment with implementing security safeguards under India’s Digital Personal Data Protection Act.
Article Details
- Publisher
- Zscaler
- Report Period
- 2026 edition; cited ransomware analysis covers April 2024 to April 2025.
- Scope
- Cybersecurity, AI security, data protection, and Zero Trust architecture for India's critical information infrastructure.
- Key Statistics
- ThreatLabz reported a 145.9% year-over-year increase in ransomware attacks in its April 2024–April 2025 analysis.
- Public ransomware extortion listings increased 70.1% year-over-year; leak-site listings do not independently confirm incidents.
- ThreatLabz analysis of 10 major ransomware families identified 238.5 TB of exfiltrated data, a reported 92.7% increase.
- The cited 2025 Mobile, IoT & OT Threat Report reported a 459% year-over-year increase in IoT attacks against Energy, Utilities, and Oil & Gas.
- Zscaler telemetry placed India second globally for enterprise AI activity, with reported year-over-year growth of 309.9%.
- Recommendations
- Identify mission-critical assets and prioritize protection according to business impact.
- Replace broad network access with continuously verified, least-privilege access to specific applications, including time-limited third-party access.
- Segment IT and OT environments and inspect device-initiated outbound communications to contain compromise and prevent data loss.
- Discover and govern employee AI usage, enforce approved-application access policies, and inspect prompts and responses for sensitive data.
- Establish responsible AI development policies, validate AI-generated outputs, and maintain experienced human oversight during deployment.
MITRE ATT&CK
T1078 · Valid AccountsIn the Colonial Pipeline example, attackers used stolen user login credentials to gain access.T1195.002 · Compromise Software Supply ChainThe report describes attackers taking control of MeDoc's software update mechanism to compromise downstream customers.T1486 · Data Encrypted for ImpactThe Colonial Pipeline attack description states that attackers encrypted billing application data for ransom.T1566.002 · Spearphishing LinkAPT36 phishing lures contained links redirecting victims to deceptive government-themed login pages.T1583.001 · DomainsAPT36 reportedly registered multiple domains hosting pages masquerading as the official Kavach app download portal.T1608.005 · Link TargetAPT36 reportedly used Google Ads paid search to promote malicious domains to users searching in India.
People
GK GoswamiContributed the section on operationalizing DPDP compliance through security-by-design and Zero Trust architecture.Jay ChaudhryZscaler Founder, Chairman, and CEO; report contributor and foreword author.Rajesh PantReport contributor and former India's National Cyber Security Coordinator, serving between 2019 and 2023.Sanjit GanguliZscaler CTO-in-Residence specializing in Zero Trust strategy and report contributor.Vishal GautamDirector of Zscaler AI & Cyber Threat Research Center - India and report contributor.
Threat Actors
APT36Described as a Pakistan-based group targeting Indian government and defence organisations through phishing, malware delivery, and data theft; explicitly identified as Transparent Tribe.Salt TyphoonThe report attributes a years-long campaign affecting US telecommunications companies to a Chinese nation-state actor identified by this name.SPIRE CASTLECloudSEK reportedly identified this China Nexus group as targeting Manufacturing through supply-chain compromises to obtain persistent OT access.Transparent TribeExplicitly identified as another name for APT36, the Pakistan-based group targeting Indian government and defence organisations.
Malware
Akira- **Ransomware groups are evolving fast**: Established families like RansomHub, Clop, and Akira remained dominant, while 34 new groups emerged as identified by ThreatLabz, including rebrands or offshoots of defunctClop- **Ransomware groups are evolving fast**: Established families like RansomHub, Clop, and Akira remained dominant, while 34 new groups emerged as identified by ThreatLabz, including rebrands or offshoots of defunctGafgytMozi, and Gafgyt account for ~75% of malicious IoT payloads,Mirai− Botnets and edge-device exploitation remain dominant. Mirai,MoziMozi, and Gafgyt account for ~75% of malicious IoT payloads,RansomHub- **Ransomware groups are evolving fast**: Established families like RansomHub, Clop, and Akira remained dominant, while 34 new groups emerged as identified by ThreatLabz, including rebrands or offshoots of defunct
Vendors
Products
Countries
ChinaCloudSEK reported APT41 (China Nexus) is heavily focused on the ManufacturingIndia# Securing Digital India Against AI & Cyber Threats: Leveraging AI Security & Zero TrustNorth KoreaGenAI-enhanced malware and social engineering in North KoreaPakistanAPT36 (Transparent Tribe), a Pakistan-based advanced persistent threat group,Ukrainenetwork at the outset of Russia’s invasion of Ukraine is a widely cited example;United StatesWith experience spanning across India and the United States, he has contributed significantly to scaling Zscaler’s engineering capabilities and establishing India as a core hub for innovation and product development.
Industries
Banking and financial services- [Critical Sector: Banking and Financial Services](#critical-sector-banking-and-financial-services)Defence- [Defence and National Security Systems by Lt General Rajesh Pant](#defence-and-national-security-systems-by-lt-general-rajesh-pant)Government- [Critical Sector: Government - The Foundational Layer](#critical-sector-government---the-foundational-layer)Healthcare- **Critical industries continue to be prime targets**: Manufacturing, Technology, and Healthcare experienced the highest number of ransomware attacks, while sectors like Oil & Gas (+935%) and Government (+235%) sawManufacturing- [Critical Sectors: Manufacturing and Strategic Enterprise](#critical-sectors-manufacturing-and-strategic-enterprise)Oil and gasTechnology, and Healthcare experienced the highest number of ransomware attacks, while sectors like Oil & Gas (+935%) and Government (+235%) saw notable year-over-year spikes.Power & Energy- [Critical Sector: Power & Energy](#critical-sector-power--energy)Technology> Cybersecurity at national scale cannot be achieved by technology teams alone.Telecommunicationstelecommunications, can cascade across the national fabric, threatening economicTransportationbackdoors—to be able to disrupt or destroy vital services like power, water, communications, or transportation, at a moment of their choosing, for strategic or geopolitical advantage.