Practical cybersecurity, in plain language.

For everyone

How to spot a phishing message

Phishing messages pretend to come from someone you trust, like a bank, a delivery company or your own boss, to trick you into clicking a link, sharing an OTP or sending money. They arrive by email, SMS and WhatsApp.

Warning signs

• Urgency or fear: “Your account will be blocked today”, “Pay now to avoid a penalty”.
• A request for OTPs, PINs or passwords. Genuine banks and companies never ask for these.
• Look-alike links: a sender or website address that is slightly off, such as extra words, misspellings or unusual domains.
• Unexpected attachments or prizes you didn’t ask for.
• A “boss” or “friend” asking for money or gift cards from a new number.

What to do

Don’t click, reply or call numbers in the message. Contact the organization directly using a number or website you already know. If you’ve lost money in India, call the national cybercrime helpline 1930 immediately and report it at cybercrime.gov.in.

For everyone

Passwords & 2FA: the 10-minute upgrade

Most account takeovers happen because of reused or weak passwords. These steps take minutes and stop the majority of attacks.

1. Use a password manager to create and remember a different, long password for every account.
2. Use passphrases: four or more random words are easier to remember and harder to crack than short complex passwords.
3. Turn on two-factor authentication (2FA) for email, banking, social media and work accounts. An authenticator app is safer than SMS.
4. Secure your email first. Whoever controls your email can reset almost every other password.
5. Never share OTPs, not even with someone claiming to be from your bank or our team.

For businesses

Signs your website may be hacked

• Visitors are redirected to strange sites, or see pop-ups you didn’t add.
• Google shows a “This site may be hacked” warning, or your search results show spam pages in your name.
• New admin users, files or plugins appear that nobody on your team created.
• Your hosting provider reports unusual traffic, spam emails or high resource use.
• Customers tell you they received suspicious emails or payment requests from you.

Prevention: keep your CMS, themes and plugins updated, remove what you don’t use, enable 2FA for admin accounts, take regular offline backups and get a periodic penetration test (VAPT) to find weaknesses early. See how our testing works →

For businesses

The first hour after a cyber incident

What you do in the first hour can decide how much damage an attack causes, and whether you can find out what happened.

1. Stay calm and contain. Disconnect affected devices from the network (unplug or turn off Wi-Fi), but don’t switch them off or wipe them.
2. Preserve evidence. Don’t delete files, emails or logs. Take photos or screenshots of ransom notes and error messages.
3. Secure accounts. From a clean device, change passwords for email, admin and banking accounts, and enable 2FA.
4. Call for help. Bring in an incident response team for a forensic investigation. Contact us for urgent help.
5. Report it. Organizations in India may be required to report certain cyber incidents to CERT-In within 6 hours. Report financial fraud on 1930 or at cybercrime.gov.in.

For students

How to start a career in cybersecurity

You don’t need to be a genius or a coder from day one. You need strong fundamentals, lots of hands-on practice and the right ethics.

1. Learn the fundamentals: how computers, networks, Linux and the web work. Security is built on top of these.
2. Practise legally: use intentionally vulnerable labs and capture-the-flag (CTF) challenges. Never test systems you don’t have permission to test.
3. Pick a direction: web and application security, network security, digital forensics, cloud security or security operations (SOC).
4. Earn recognised certifications once you have the basics, for example EC-Council’s Certified Ethical Hacker (CEH).
5. Build proof of skill: write-ups of labs, responsibly reported vulnerabilities and projects you can show employers.