The 'No Deviation' Mirage: How Standardized SEBI Filings Mask Systemic Cybersecurity Risks

A troubling pattern is emerging in India's corporate regulatory landscape that should alarm cybersecurity and governance professionals worldwide. Multiple listed companies, including major players like Info Edge (parent company of Naukri.com and 99acres) and mid-cap firms such as Vipul Organics, Desh Rakshak Aushdhalaya, and Jupiter Wagons, have recently filed near-identical quarterly compliance reports with the Securities and Exchange Board of India (SEBI). These filings, submitted under Regulation 32 of the SEBI Listing Obligations and Disclosure Requirements (LODR), uniformly declare 'no deviation' or 'nil deviation' in the utilization of funds raised through preferential issues or Qualified Institutional Placements (QIPs).

While on the surface these filings represent routine compliance, cybersecurity experts are raising red flags about what this standardization might be concealing. The identical nature of these disclosures across diverse industries—from pharmaceuticals to logistics to technology—suggests a compliance exercise that has become disconnected from actual operational realities and security postures.

The Compliance Facade and Cybersecurity Blind Spots

Regulation 32 requires companies to disclose any material deviations in the use of proceeds from fundraising activities. However, when every company reports identical 'no deviation' status quarter after quarter, it raises questions about whether these filings are genuine assessments or merely box-ticking exercises. For cybersecurity professionals, this is particularly concerning because:

1. Fund Misuse and Security Underinvestment: The 'no deviation' declarations theoretically confirm that funds are being used exactly as stated in offering documents. However, in practice, this could mask situations where cybersecurity budgets are being diverted to other areas while compliance filings suggest adequate security investment.

1. Governance Decoupling: The simultaneous resignation of Jet Freight Logistics' internal auditor, N A R A D And Associates LLP, due to 'firm reconstitution' highlights governance instability that standardized filings fail to capture. Internal auditors play a crucial role in cybersecurity oversight, and their departure often signals deeper governance issues.

1. Board-Level Cybersecurity Oversight: The completion of Choice International Limited's independent director's five-year tenure raises questions about board refreshment and cybersecurity expertise at the governance level. Independent directors with cybersecurity backgrounds are essential for proper oversight, yet standardized filings show no indication of board competency in this area.

Systemic Risks in the Making

The real danger lies in the systemic nature of this compliance pattern. When multiple companies across sectors file identical compliance statements, it creates several interconnected risks:

• Normalization of Superficial Compliance: Companies may prioritize filing the 'correct' paperwork over conducting genuine security assessments, creating a culture where appearance matters more than substance.

• Auditor and Regulator Overload: With thousands of nearly identical filings to review, regulators and auditors may struggle to identify genuinely problematic cases, allowing real vulnerabilities to go unnoticed.

• Investor Misinformation: Investors relying on these filings for due diligence may develop a false sense of security about companies' operational integrity and cybersecurity posture.

The Cybersecurity Implications

From a technical cybersecurity perspective, this compliance pattern creates specific vulnerabilities:

1. Supply Chain Risks: Companies like Jupiter Wagons (logistics) and Vipul Organics (chemicals) operate in sectors with complex digital supply chains. Standardized compliance filings may obscure inadequate security controls in vendor management and third-party risk assessment.

1. Data Integrity Concerns: Info Edge's 'nil deviation' filing is particularly noteworthy given its operation of major job and real estate portals handling sensitive personal data. The disconnect between compliance paperwork and actual security controls could indicate inadequate data protection measures.

1. Incident Response Gaps: The perfunctory nature of these filings suggests companies may have similarly standardized their incident response plans without proper customization to their specific risk profiles.

Recommendations for Cybersecurity Professionals

Security teams and CISOs should view these developments as warning signs and consider several proactive measures:

• Beyond-Compliance Assessments: Develop internal security metrics that go beyond regulatory requirements to provide a true picture of security posture.

• Governance Integration: Ensure cybersecurity leadership has direct reporting lines to boards and audit committees, bypassing potentially complacent compliance functions.

• Third-Party Verification: Implement regular external security audits that operate independently of routine compliance checks.

• Investor Communication: Develop transparent cybersecurity disclosures for investor relations that provide more meaningful information than standardized regulatory filings.

The Global Context

While this investigation focuses on Indian markets, the phenomenon is not unique to SEBI-regulated entities. Similar patterns exist in other jurisdictions where regulatory compliance has become standardized and disconnected from operational reality. The lessons from India's 'no deviation' filings should serve as a cautionary tale for cybersecurity professionals worldwide about the dangers of compliance becoming an end in itself rather than a means to ensure genuine security and governance.

As regulatory bodies increasingly focus on cybersecurity requirements, there's a risk that companies will respond with similarly standardized, superficial compliance rather than meaningful security improvements. The challenge for the cybersecurity community is to bridge this gap between regulatory paperwork and operational security, ensuring that compliance drives genuine risk reduction rather than merely creating paper trails that mask systemic vulnerabilities.