For two decades, Indian enterprises have secured themselves around a simple idea: protect the device and you protect the business. Laptops, desktops and servers were where users worked, where data lived and where attackers landed, so the endpoint became the unit of defence and security budgets followed. That model is now under strain. Enterprises are putting GPU clusters, AI models, APIs, cloud-native workloads and a growing population of machine identities into production, and the IndiaAI Mission and private sovereign-cloud builds are adding GPU capacity at a pace few expected. The question for CISOs is no longer whether to adopt AI, but whether a security architecture designed around endpoints can protect an enterprise whose most valuable assets no longer sit on them.
Endpoint protection is not obsolete. Most intrusions in India still begin with a phished credential, a poisoned attachment or an unpatched device, and ransomware operators still need an endpoint to establish a foothold and move laterally. Our Threat Research Unit (TRU) continues to see this pattern across the region, and any enterprise that relaxes its endpoint discipline because it is excited about AI will pay for it. But endpoint security answers the question “is this device safe?” The AI enterprise asks a different one: “is this workload, model, pipeline or identity safe, wherever it runs?” A large share of that estate has no agent to install and no user to train.
Consider what the AI enterprise adds to the attack surface. GPU clusters are expensive, shared and often stood up quickly by data science teams outside normal change control, which makes them attractive for cryptomining, compute hijacking and as a path into training data. Models are business assets that can be stolen, tampered with or poisoned, and a compromised model can behave normally in testing and fail when it matters. Every model is consumed through APIs, and over-permissive endpoints, weak authentication and unchecked inputs expose both the model and the data behind it. Prompt injection and data leakage through model outputs are new variants of an old problem: unvalidated input reaching a system that trusts it. Training pipelines add further risk, pulling data from multiple stores, third-party libraries and pre-trained components across hybrid and multi-cloud environments, where trust is often assumed rather than verified.
The least visible risk is machine identity. Service accounts, API keys, tokens and certificates now outnumber human users in many enterprises, and AI agents are adding more. They are rarely inventoried, often over-privileged and seldom rotated. A single leaked key can open a path that no endpoint agent will ever see.
This is why the endpoint-centric model falls short, and the reasons are structural. The first is visibility: endpoint tools see what happens on a device, not the traffic between containers, the calls between services, or who invoked a model with what permissions. An attacker operating through valid credentials and legitimate APIs may never trigger an endpoint alert. The second is speed: AI workloads spin up and down in minutes across environments, while device-centric controls assume a stable asset inventory that no quarterly audit can keep up with. The third is recovery. When an endpoint is compromised, you re-image it. When a training dataset is corrupted, a model is poisoned or a pipeline is encrypted, recovery means restoring a known-good state across data, configuration and model versions, and many organisations have backed up their files but not their AI pipelines. They discover the gap during an incident.
The exposure is already visible in the sectors adopting AI fastest. In healthcare and pharma, AI is used for diagnostics, imaging, drug discovery and clinical-trial analysis. The data is sensitive and the models are proprietary research assets, so poisoned training data or a leaked model carries clinical, regulatory and commercial consequences, with India’s data protection framework and CERT-In reporting obligations raising the stakes further. In manufacturing, AI is moving onto the shop floor through predictive maintenance, quality inspection and process optimisation, where IT and operational technology converge. A compromised model or API feeding a production line is an operational and safety risk as well as a data risk, and endpoint tools built for office laptops were never designed for these environments. In both, the business value now sits in data, models and automated decisions, and security investment has to follow.
The answer is to extend the architecture, not abandon endpoints. Endpoint telemetry should feed a unified detection and response capability that also covers cloud, identity and network signals, so that an alert on a laptop can be correlated with an unusual API call. Machine identities need to be treated as first-class citizens: inventoried, held to least privilege, rotated automatically and monitored as closely as human users. The AI pipeline needs end-to-end protection, from validating data sources and scanning dependencies to controlling who can modify or deploy models and watching them in production for abuse. Recoverability has to be designed and rehearsed across data, configurations and model artefacts, because cyber resilience is judged by how quickly the business returns to a trusted state, not by how many attacks were blocked. And defenders need threat intelligence that reflects how adversaries are actually adapting to cloud and AI environments, which is where research from teams like our TRU helps organisations prioritise.
For the many mid-sized Indian enterprises, including those in Tier-2 and Tier-3 cities adopting AI through cloud services rather than building their own clusters, the channel ecosystem will matter as much as the technology. Partners and managed service providers are often the ones who translate this architecture into something an organisation with a small security team can actually run.
So, does the endpoint-centric architecture still work for the AI enterprise? It works for the endpoint, and that is the problem. It remains necessary but is no longer sufficient, because the assets that matter most are now workloads, models, APIs and identities that sit outside its field of view. India’s AI ambition is real and moving fast. The enterprises that sustain it will be those that extend protection to where the value now lives and plan for recovery as seriously as they plan for defence. Done right, security is not the brake on AI adoption; it is what makes that adoption trustworthy and scalable.
Authored by Rajesh Chhabra, General Manager, India and Asia, Acronis
