Rehearsing the worst day

Bharat NCX 2025, India’s National Cybersecurity Exercise, ran real-world attack simulations spanning AI-driven threats, deepfakes and industrial control system scenarios. CERT-In also ran scores of drills involving more than a thousand public and private organisations across defence, finance, power, telecom and other critical sectors.

The headline takeaway wasn’t a new tool. It was a posture: assume breach.

From prevention to containment

Traditional security asks "how do we keep attackers out?" The assume-breach posture adds a sharper question: "when someone gets in, how fast can we detect and contain them?"

This reframes how security teams are judged — not only on prevention, but on response speed. It’s a recognition that perfect prevention is a myth, especially when most intrusions now start with a person being deceived rather than a system being hacked.

The perimeter will fail. What separates a contained incident from a headline is how quickly your people and processes react.

What this means for your employees

Assume-breach isn’t just a SOC strategy — it depends on the workforce:

Fast reporting is containment. The minutes between a click and a report decide the blast radius. Make reporting one tap.
No-blame culture. Employees who fear punishment hide mistakes; employees who feel safe raise alarms early.
Everyone is a sensor. A receptionist spotting an odd vendor email is threat detection.
Rehearse, don’t just document. Tabletop the "someone clicked" scenario before it happens for real.

The bottom line

Bharat NCX 2025 made the national direction clear: resilience beats the illusion of impenetrability. For private enterprises, that starts by treating every employee as part of the detection and response system — trained, drilled, and unafraid to hit the report button.