Combating Advanced Persistent Threats: A Practical Defence Guide for Indian Enterprises

• 08 August, 2026
• No Comments

Advanced Persistent Threats (APTs) have become one of the most formidable challenges facing Indian enterprises today. Unlike opportunistic ransomware campaigns or drive-by malware, APT actors — typically nation-state groups or highly organised criminal syndicates — operate with patience, precision, and purpose. They infiltrate networks silently, dwell for months, exfiltrate sensitive data, and exit before most security teams even detect their presence.

For Indian CISOs and IT leaders, the threat landscape is particularly acute. India is now among the top-five most targeted nations for cyber espionage, and sectors ranging from defence manufacturing to pharmaceutical R&D, banking, and critical infrastructure are squarely in the crosshairs of sophisticated threat actors. Understanding how APTs operate — and how to structurally defend against them — is no longer optional; it is a board-level imperative.

What Makes APTs Different from Commodity Threats?

Commodity threats — phishing campaigns, ransomware-as-a-service, botnet infections — are largely indiscriminate. APT actors, by contrast, invest weeks or months in reconnaissance before launching a single packet. Their operations typically follow a well-documented lifecycle:

• Reconnaissance: Open-source intelligence (OSINT), LinkedIn mapping of IT staff, supplier chain analysis.
• Initial Access: Spear-phishing emails crafted to look like legitimate vendor communications; watering-hole attacks on industry portals; exploitation of edge-device vulnerabilities (VPNs, firewalls, email gateways).
• Persistence & Lateral Movement: Deployment of custom implants; abuse of legitimate tools like PsExec, WMI, and scheduled tasks (Living off the Land); credential harvesting and privilege escalation.
• Command & Control (C2): Encrypted, low-and-slow beaconing over HTTPS or DNS to evade detection; use of compromised legitimate cloud services as C2 relay nodes.
• Exfiltration: Slow, staged data extraction — often compressed and disguised as routine business traffic — to minimise anomaly alerts.

The dwell time for APTs — the period between initial compromise and detection — still averages over 200 days globally. In resource-constrained environments without mature SOC capabilities, that window stretches even further.

The Indian Regulatory Context: DPDP Act and CERT-In Obligations

Beyond the operational damage, Indian enterprises face a tightening regulatory net. The Digital Personal Data Protection (DPDP) Act, 2023 places clear obligations on data fiduciaries to implement technical safeguards for personal data — and an APT breach that exfiltrates customer or employee data will be scrutinised under this lens.

More immediately, CERT-In’s April 2022 directions mandate that organisations report cyber incidents to CERT-In within six hours of becoming aware of the breach. APTs, by design, are discovered late. If your detection capabilities are weak, the six-hour clock starts ticking at the moment of awareness — but forensic reconstruction of the attack timeline for the incident report requires evidence that was never collected or has already been overwritten.

Key implication: Organisations that lack centralised log retention and correlation cannot meaningfully comply with CERT-In’s reporting obligations for APT-class incidents. The report CERT-In expects requires knowing what was accessed, when, and from where — all of which demand comprehensive logging infrastructure.

Structural Defences: Building an APT-Resistant Architecture

1. Zero Trust Network Access (ZTNA)

Traditional perimeter security is architecturally inadequate against APTs that gain initial access through trusted endpoints or supply-chain compromises. ZTNA — where every user, device, and session is verified before accessing any resource — dramatically reduces lateral movement opportunities. Implementing ZTNA means:

• Micro-segmentation of application workloads so that a compromised endpoint in HR cannot reach ERP production databases.
• Identity-based access controls with continuous verification (MFA + device posture checks), not just point-in-time authentication.
• Replacing legacy VPN with application-specific, least-privilege tunnels — eliminating the “hub-and-spoke all-access” problem that VPNs create.

2. Next-Generation Firewall (NGFW) with Deep Inspection

FortiGate NGFWs provide the first and most critical line of defence against APT initial access vectors. Key capabilities that matter in an APT context include:

• SSL/TLS deep inspection: A significant portion of APT C2 traffic rides HTTPS. Without decryption and inspection, this traffic is invisible. FortiGate’s SSL inspection, properly configured, catches malicious payloads even in encrypted channels.
• DNS filtering: APTs frequently use Domain Generation Algorithms (DGAs) and fast-flux DNS for C2. FortiGuard DNS filtering identifies and blocks these patterns in real time.
• Intrusion Prevention System (IPS): FortiGate’s IPS engine, fed by FortiGuard threat intelligence, detects known APT lateral-movement techniques and exploitation of vulnerabilities including zero-days that have been weaponised in the wild.
• Application control: Restricting which applications can initiate outbound connections — critical for containing Living-off-the-Land binaries that APTs abuse.

3. Email Security: Closing the Spear-Phishing Gap

The single most common APT initial-access vector remains email. FortiMail provides multi-layer protection including:

• Sandboxed detonation of attachments before delivery.
• URL rewriting and time-of-click scanning — catching malicious links even when they resolve to benign content at delivery time and flip post-click.
• BEC (Business Email Compromise) detection using AI-based impersonation analysis.
• DKIM/DMARC/SPF enforcement to prevent domain spoofing by threat actors impersonating your own organisation.

4. Endpoint Detection and Response (EDR) and Threat Hunting

Preventive controls fail. EDR provides the visibility layer to catch what gets through. For APT defence, EDR must be paired with proactive threat hunting — analysts actively searching for Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) rather than waiting for alerts. This means regularly hunting for:

• Unusual parent-child process relationships (e.g., Office spawning PowerShell).
• Encoded or obfuscated command-line arguments.
• Scheduled tasks or registry run-keys not associated with known software.
• Unexplained outbound connections to low-reputation or newly-registered domains.
• Credential access events (e.g., LSASS memory reads, Kerberoasting indicators in AD logs).

The PrahiX Ora Platform: Unified SecOps Visibility for APT Detection

Structural controls reduce the attack surface, but APT detection fundamentally depends on telemetry — the breadth, depth, and quality of data your security operations team can see and correlate. This is where the PrahiX Ora platform, which PJ Networks deploys and operates for clients, becomes operationally decisive.

PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd that brings together SIEM, Network Management (NMS), Video Surveillance (VMS), and SOAR into a single operational layer. Here is how each pillar directly addresses APT detection and response challenges for Indian enterprises:

SIEM: Correlation Across the Kill Chain

An APT attack leaves traces across dozens of log sources — firewall syslogs, Active Directory events, email gateway records, endpoint telemetry, DNS query logs, and cloud access logs. PrahiX Ora’s SIEM ingests all of these, normalises them, and applies correlation rules mapped to the MITRE ATT&CK framework — the industry-standard taxonomy for APT techniques, tactics, and procedures. Its graph-based attack storyline reconstruction allows analysts to visualise the full attack chain rather than triaging individual alerts in isolation.

For Indian enterprises, CERT-In’s direction on 180-day in-country log retention is a specific compliance requirement. PrahiX Ora’s tiered retention model (hot, warm/cold, and archive) enables organisations to maintain the mandated retention periods cost-effectively while keeping recent events immediately queryable for incident investigation.

NMS: Fragmented NOC Visibility Solved

Many Indian enterprises operate multi-vendor network estates — FortiGate firewalls alongside other vendors’ switches, multiple ISP links, SD-WAN overlays, and geographically dispersed branches. PrahiX Ora’s Network Management System provides unified observability across all of these, using LLDP/CDP topology discovery to automatically map the network and network path tracing to identify anomalous communication flows. ML-based anomaly detection flags deviations from baseline behaviour — including the low-and-slow C2 beaconing patterns characteristic of APT actors — and auto-healing policies can trigger remediation actions before the SOC analyst even opens a ticket.

Video Surveillance (VMS): Physical and Network Security Converged

For manufacturing, retail, and multi-site organisations, physical security and network security incidents are often correlated but managed by separate teams using separate tools. PrahiX Ora’s video surveillance (VMS) module — supporting ONVIF, Hikvision, and Dahua camera management with video analytics — brings physical access events into the same operational view as network security events. A door-access event outside business hours correlated with a VPN authentication event from the same location is a meaningful signal that siloed tools would never surface.

SOAR: Making the 6-Hour CERT-In Window Achievable

CERT-In’s six-hour incident reporting window is a significant operational challenge. Manual investigation, escalation, and reporting within six hours of awareness is near-impossible for complex APT incidents without automation. PrahiX Ora’s SOAR module addresses this with pre-built playbooks and automated response actions — including pushing blocklists directly to FortiGate firewalls — that dramatically compress the time between detection and containment. Automated evidence collection and timeline construction mean that when the six-hour clock is running, analysts are reviewing pre-assembled incident summaries rather than starting from raw logs.

For organisations considering deploying PrahiX Ora, PJ Networks provides end-to-end deployment, integration, and 24/7 managed operations.

Building Your APT Response Playbook: A Checklist for Indian CISOs

Preparation before an incident is what determines how quickly an organisation recovers. Use this checklist to assess your current readiness:

• Detection coverage: Do you have endpoint, network, email, and identity log sources feeding a SIEM? Are correlation rules tuned for APT-relevant MITRE ATT&CK techniques?
• Log retention: Are logs retained for at least 180 days in India (per CERT-In direction)? Is retention auditable for compliance evidence?
• Segmentation: Is micro-segmentation in place to limit lateral movement? Has it been tested via tabletop or red-team exercise?
• Email controls: Is attachment sandboxing, URL scanning, and DMARC enforcement fully deployed and monitored?
• Incident response plan: Is there a documented, tested playbook that includes the six-hour CERT-In notification obligation? Are roles clear?
• Threat intelligence: Are IOCs from credible feeds (FortiGuard, CERT-In advisories, MISP) being operationalised in your NGFW and SIEM?
• Threat hunting cadence: Does the SOC team proactively hunt for APT indicators at least monthly, not just respond to alerts?
• Third-party risk: Have supply-chain vendors been assessed for security posture? Is vendor access segmented and monitored?

The Managed Security Advantage

Building in-house capability to detect and respond to APTs is genuinely difficult. It requires not just technology — SIEM, SOAR, EDR, NGFW — but also people with the rare expertise to operate it and interpret what it finds. The global shortage of skilled cybersecurity professionals is particularly acute in India, making it hard for most enterprises to staff a mature SOC independently.

PJ Networks’ Managed Security Services provide Indian enterprises with access to a 24/7 NOC/SOC team operating FortiGate, FortiMail, and the PrahiX Ora platform across client environments. Our analysts handle everything from initial deployment and tuning to ongoing threat hunting, incident response, and regulatory reporting support.

The cost comparison is stark: building equivalent capability in-house — hiring experienced analysts, procuring and operating the technology stack, maintaining the threat intelligence subscriptions — typically costs three to five times more than a managed service engagement. For mid-market and enterprise organisations in India, managed security is not a compromise; it is the commercially rational path to genuine APT-class defence.

Next Steps

If your organisation is re-evaluating its defensive posture in light of the evolving APT threat landscape, PJ Networks offers a structured security assessment covering your network architecture, SOC maturity, and regulatory compliance readiness (DPDP Act, CERT-In). The assessment identifies gaps across people, process, and technology — and provides a prioritised roadmap you can act on.

To schedule a no-obligation assessment or to discuss how PJ Networks can help your organisation build APT-resilient defences, contact us at pjnetworks.com/contact.