05 Nov 2026 5 min read Cybersecurity

Shooting the Messenger: Why Indian Companies Ignore the People Who Warn Them

Cyber Moral analysis, on the gap between what we preach and what we practise.

On 22 October 2026, security researcher Harsh Khandelwal posted something many in the field had been thinking: "we have reported vulnerabilities in hundreds of companies in India. Almost all the companies rejected it, got defensive and now i'm so afraid the exploits are just left open." He added that the list included some of the country's biggest healthcare, finance and banking companies.

It is tempting to call that a stupid mistake. It is worse than that: it is a rational one. When a stranger emails to say they have found a hole in your bank, every incentive a company faces in India today, legal, reputational and procedural, pushes it to deny, delay or threaten.

The result is a strange kind of trust failure. The companies distrust the people trying to help them, the researchers distrust the companies, and the attackers, who never send an email first, are the only ones not slowed down.

Why companies get defensive

Picture where an unsolicited report actually lands. It arrives at a generic support inbox or a social media handle. Whoever reads it first is rarely a security engineer. To them, the message looks like one of three things.

A legal risk. If the bug is real, the company may now have to report an incident, notify customers or explain itself to a regulator. Admitting the report is admitting the problem.
A reputation risk. A vulnerability in a bank's app is a headline. The instinct is to contain the story, and the researcher is part of the story.
An extortion attempt. Some "reports" really are shakedowns: pay us or we publish. Without a process to tell the difference, every report gets treated as the worst case.

So the report goes to legal or PR, not engineering. The reply, if one comes, is a denial or a warning. The bug stays open, and the company files the episode as a threat it handled.

None of this is stupidity. It is what any organisation does when it has no process, no protection and no reward for saying "thank you, we're fixing it."

The legal gap: no safe harbour on either side

India does have a disclosure policy. CERT-In released its Responsible Vulnerability Disclosure and Coordination Policy on 3 September 2021. It explains where to report a bug, what to include, and how CERT-In will examine and coordinate the fix.

What it does not do is protect anyone. Clause 7 says the person reporting "must ensure to comply with all the extant laws and regulations while discovering the vulnerabilities." When the Internet Freedom Foundation asked about this, CERT-In replied that the policy is "non-statutory in nature and not a law itself," and that it "cannot own the responsibility nor is competent to exempt anyone from legal obligations."

That leaves the researcher exposed under the IT Act. Section 43 covers unauthorised access to a computer system, and it makes no exception for someone acting in good faith. IFF has asked MeitY to amend it so that companies cannot bring vexatious claims against security testers.

The result is a stand-off:

Side	What it fears	What it does
Researcher	A complaint under the IT Act for finding the bug	Reports anonymously, reports nothing, or goes public to force a response
Company	Liability, disclosure duties, bad press, extortion	Denies, ignores, or sends a legal notice
Attacker	Nothing in this process	Finds the same bug and uses it

The only party the current system does not slow down is the one it exists to stop.

How a report should travel

Today, a company that stays silent leaves the researcher with two choices: walk away or go public. A coordinated path with a regulator at the end offers a third option and removes the reason for public threats.

Building trust: what each side must do

Trust is not a feeling here. It is a process that makes good-faith reporting safe, predictable and worth doing, on all three sides.

Companies: make reporting safe and boring

Publish a vulnerability disclosure policy and a security.txt file. Say where to report, what is in scope, and that good-faith reports will not face legal action.
Route reports to security, not legal or PR. Acknowledge within 72 hours and set fix deadlines by severity.
Measure it at board level. Reports received, how many were valid, and the median days to fix. A board that sees these numbers stops treating reports as attacks.
Use a neutral party if direct contact is uncomfortable. CERT-In or a bug bounty platform can sit between the company and the researcher.
Say thank you in public. A hall of fame or a bounty costs little and tells every future reporter they are welcome.

Researchers: earn the trust you ask for

Prove the issue with as little access as possible. Never pull, keep or show real customer data.
Report privately and in writing, with clear steps to reproduce, and copy CERT-In when a company goes quiet.
Set a disclosure timeline and keep to it. Ninety days is a common norm.
Avoid public warnings and predictions. A post saying a named sector will be "hacked in the coming week" reads as a threat to the company and as a target list to an attacker, even when it comes from real frustration.

Regulators: change the incentives

Create a legal safe harbour. Amend Section 43 of the IT Act, or add a good-faith exemption in the data protection rules, for researchers who follow a published process.
Make disclosure programmes mandatory in regulated sectors. RBI, SEBI, IRDAI and health regulators could require one from banks, brokers, insurers and hospitals, with fix times reported.
Turn CERT-In into an escrow. If a company ignores a coordinated report past its deadline, CERT-In escalates to the sector regulator, so the researcher never needs to go public.

The moral

You cannot claim to take security seriously and treat the people who find your flaws as enemies.

Almost every large Indian company preaches security. It is in the annual report, the ISO 27001 certificate and the line on the login page that says "your data is safe with us."

What a company practises shows up somewhere smaller: in the reply to a stranger's email at 11 p.m. that says "I found a way into your system." A legal notice tells that stranger, and everyone they talk to, never to try again. A thank-you and a fix date tells them the opposite.

Attackers will never send that email. The researchers who do are the cheapest security audit a company will ever get, and right now most companies are sending them away.