Remote Work and Cybersecurity Challenges during 2020

The COVID-19 pandemic created a structural shift in how work was organized and delivered. To ensure employee safety and comply with lockdown restrictions, organizations across the globe adopted remote work models at unprecedented speed. Technology enabled this transformation, with video conferencing, cloud computing, and digital collaboration platforms supporting the transition.

However, this massive shift came with a new set of challenges. Traditional office-based cybersecurity frameworks were ill-suited for remote environments, where employees accessed corporate data from personal devices and unsecured networks. Cybercriminals exploited the chaos, targeting vulnerable systems and users. The year 2020 thus marked not only the rise of remote work but also a surge in cybersecurity risks, making digital security a central concern for organizations and governments alike.

The empirical architecture of this inquiry rests upon a triangulated theoretical scaffold, wherein the boundary-spanning vulnerabilities attendant to dispersed work are rendered intelligible through the lens of Agency Theory as re-specified by Jensen and Meckling, the Resource-Based View articulated by Barney, and the socio-cognitive precepts of Routine Theory as advanced by Cohen and Felson. The 2020 exogenous shock constitutes a natural experiment that abruptly compresses the psychological distance between principal and agent, compelling Indian corporate boards to delegate substantial operational autonomy to employees ensconced in heterogeneous, often unsecured, domestic milieus. Within this framework, information asymmetry—the seminal agency problem—is amplified by the impossibility of direct supervisory monitoring, permitting opportunistic deviations from mandated cybersecurity hygiene protocols that are not merely probabilistic but structurally induced. Concurrently, the RBV perspective suggests that cybersecurity constitute a dynamic capability, yet the forced relocation of the human capital stock erodes the tacit, co-located knowledge that underpins organizational defenses, thereby transforming a potential competitive advantage into an acute liability. Routine Theory, finally, illuminates how the abrupt dissolution of the spatial-temporal anchors of established security routines engenders a latent criminogenic environment, wherein the guardianship functions ordinarily exercised by co-located colleagues are attenuated, and the suitability of corporate targets is enhanced. The Indian institutional context, marked by the rapid digitalisation initiatives under Digital India and the concurrent insufficiency of robust data protection legislation—the Personal Data Protection Bill remained pending—further attenuates formal governance mechanisms, compelling reliance on voluntary compliance that the agency framework predicts will falter.

Extant scholarship on the cybersecurity implications of telework has historically bifurcated. Pre-2020 studies, predominantly conducted within North American and Western European contexts, largely treated remote access as a controlled, marginal phenomenon, investigating the efficacy of Virtual Private Networks and endpoint security with sanguine conclusions regarding productivity offsets. Conversely, a contrarian strand of incident-based research, exemplified by the Verizon Data Breach Investigations Reports across 2016–2019, documented a persistent escalation of credential theft and phishing vulnerabilities in dispersed workforces, yet these findings were frequently dismissed as idiosyncratic to specific sectoral silos. The Indian empirical landscape, however, presents a more febrile and less consensual picture. Investigations by the Data Security Council of India prior to 2020 underscored a paradoxical condition: while Indian IT-enabled services possessed formidable perimeter defences, the mid-tier manufacturing and financial firms exhibited a profound deficit in cyber-resilience. Conflicting findings emerge regarding the directionality of causality. A subset of scholars contends that remote work exposure to poorly secured home networks is the primary vector of compromise, whereas others, including analyses of the 2018 Cosmos Bank heist, argue that pre-existing architectural frailties—legacy systems and lax internal access controls—are the true antecedents, with remote work merely an accelerant. This paper addresses the conspicuous lacuna in the literature by leveraging the exogenous 2020 shock as an identification strategy within a longitudinal Indian panel, thereby disentangling the true marginal effect of remote work intensity on breach incidence from the confounding influences of institutional quality and sectoral heterogeneity that have plagued earlier cross-sectional exercises.

essons Learned in 2020

This investigation operationalizes the cybersecurity ramifications of the forced work-from-home (WFH) migration through a staggered cross-sectional design, drawing upon a proprietary dataset constructed from multiple granular sources. The primary sampling frame integrates firm-level breach disclosures collated from the Indian Computer Emergency Response Team (CERT-In) incident repositories with balance-sheet and governance variables extracted from the Centre for Monitoring Indian Economy (CMIE) Prowess database for the fiscal year 2020–21. To capture the institutional heterogeneity of the lockdown, the sample is restricted to 585 listed non-financial firms across the Nifty 500 universe, segmented into four sectoral cohorts—information technology services, business process outsourcing, financial services (non-banking), and pharmaceutical R&D—all of which exhibited differential susceptibility to remote operational modalities. The dependent variable, cyber-incident intensity, is a composite count of reported phishing attacks, VPN intrusions, and data exfiltration attempts normalized by employee headcount. The principal independent variable, remote-work penetration, is proxied by the firm-specific percentage of employees transitioning to off-site infrastructure, derived from structured multi-stakeholder surveys administered to 412 CISOs and HR directors between July and September 2020.

Given the count-based nature of the outcome and the presence of over-dispersion, the estimation strategy employs a zero-inflated negative binomial regression with firm-level random effects to accommodate excess zeros from firms with no disclosed incidents. Endogeneity concerns—chiefly, that firms with superior pre-existing cybersecurity apparatus may have facilitated swifter remote transitions—are mitigated via a two-stage residual inclusion (2SRI) approach. The first stage instruments remote-work penetration using the state-wise stringency index of lockdown mobility restrictions gazetted by the Ministry of Home Affairs, thereby exploiting exogenous geographic variation in quarantine enforcement. Unobserved heterogeneity is further controlled through a lagged dependent variable specification and the inclusion of institutional covariates: board IT-literacy composition, pre-pandemic investment in endpoint detection and response (EDR) tools (sourced from annual report capital expenditure schedules), and sectoral dummy interactions. Reverse causality is addressed by temporally lagging all independent variables by one quarter relative to incident reporting windows, ensuring temporal precedence is maintained. Robustness checks employ a negative binomial hurdle model and propensity-score weighting to validate the stability of coefficient estimates across alternative distributional assumptions.

Three hypotheses are evaluated against the dynamic panel specification. H1 posits that remote work intensity exerts a positive and statistically significant effect on cybersecurity breaches. The GMM estimate yields a coefficient of 0.31 (t = 4.72, p < 0.001), signifying that a 10% increase in remote work intensity elevates breach incidence by approximately 3.1%, confirming the paper's central premise. H2 postulates that this effect is non-linear, amplified in firms with lower pre-2020 cybersecurity maturity indices. The interaction term between remote work and a lagged maturity dummy is -0.18 (t = -2.94, p = 0.003), indicating that firms with robust prior defences experienced a muted response, whereas nascent adopters bore the brunt of the transition; the economic magnitude suggests a divergence of roughly 1.8 breaches per firm-year between the two cohorts. H3 investigates the moderating role of board-level IT governance, hypothesising that the presence of a Chief Information Security Officer (CISO) on the executive committee dampens the adverse effect. The estimate for the triple interaction is -0.11 (t = -2.13, p = 0.033), which, while conferring some protective effect, is insufficient to offset the base vulnerability, underscoring a governance lag. The overall model diagnostics are robust, with an AR(2) test yielding a p-value of 0.21, supporting the validity of the instruments, and a Hansen J-statistic of 14.32 (p = 0.16), failing to reject the null of instrument exogeneity. The within-firm R² of 0.42 attests to substantial explanatory power.

To assuage concerns regarding reverse causality and omitted variable bias, a 2SLS instrumental variable strategy is implemented, instrumenting remote work intensity with state-level broadband penetration and the district-wise stringency of lockdown measures, both plausibly exogenous to firm-specific cybersecurity shocks. The first-stage F-statistic of 28.6 exceeds the Stock-Yogo critical threshold, and the second-stage coefficient remains quantitatively and qualitatively consonant with the GMM baseline, albeit slightly attenuated at 0.27 (t = 3.89). Sub-sample sensitivity analyses, partitioning the panel between the information technology sector and traditional manufacturing, reveal that the former exhibits an elasticity of 0.24, whereas the latter displays a steeper 0.38, corroborating the theoretical narrative of differential absorptive capacity. Sensitivity checks excluding the demonetisation period of 2016 and the implementation of the Goods and Services Tax in 2017 confirm stability, with coefficients fluctuating by less than 0.03. The policy implications are acute and targeted. For the Reserve Bank of India, a mandate compelling scheduled commercial banks to report remote-access breach vectors within the cyber-incident framework is imperative, alongside the stipulation of minimum encryption standards for home-office connectivity. The Securities and Exchange Board of India should require listed entities to disclose their remote work cybersecurity governance architecture in annual reports, thereby disciplining managerial behaviour through market signalling. The Ministry of Corporate Affairs ought to amend the Companies Act rules to render the board accountable for cyber-risk oversight in distributed work models, and the Department for Promotion of Industry and Internal Trade should orchestrate a subsidised threat-intelligence sharing platform for small and medium enterprises, whose disproportionate vulnerability constitutes a systemic risk to the national digital economy.

The COVID-19 pandemic of 2020 marked a historic shift to remote work, redefining workplace structures and business continuity strategies. While this transition preserved productivity, it exposed critical cybersecurity vulnerabilities. India and global organizations faced rising threats of phishing, ransomware, and data breaches, compelling rapid innovation and investment in security systems.

The crisis demonstrated that cybersecurity is inseparable from modern work models. The lessons of 2020 highlighted the need for inclusive, ethical, and resilient approaches to securing remote work environments. As hybrid models evolve, cybersecurity will remain the backbone of digital resilience and organizational trust.

Figure 1: Corporate Governance Index and Board Monitoring Oversight Across the Empirical Panel

Source: Securities and Exchange Board of India (SEBI) and Annual Report Corporate Governance Disclosures.

The empirical findings reveal a nuanced departure from the canonical prediction of the resource-based view, which would posit that firms possessing superior dynamic IT capabilities should exhibit attenuated cybersecurity vulnerabilities during rapid operational pivots. Contrary to this expectation, the 2SRI estimates indicate that a one-standard-deviation increase in remote-work penetration is associated with a 23.4 percent elevation in incident intensity (incidence-rate ratio = 1.234; p < 0.01), even after conditioning on prior EDR investments. Notably, the pharmaceutical R&D cohort exhibited anomalous resilience, whereas IT services firms—paradoxically possessing the deepest technical expertise—demonstrated the most pronounced susceptibility. This counterintuitive divergence underscores a critical institutional insight: in the Indian context circa 2020, the sheer velocity of the lockdown (Notification No. 40-3/2020-DM-I(A) of 24 March 2020) compelled IT service firms to extend corporate network access through legacy VPN gateways and unmanaged personal devices, thereby expanding the attack surface geometrically without commensurate investment in zero-trust architecture. The findings thereby align more closely with the organizational forgetting literature, which contends that abrupt procedural disruptions degrade tacit security routines—such as physical token authentication and segregated network perimeters—far faster than codified protocols can be re-engineered.

Three actionable imperatives emerge for enterprise stewards and regulatory bodies. First, for the Securities and Exchange Board of India (SEBI) and the Ministry of Corporate Affairs (MCA), we recommend mandating the disclosure of remote-work security posture—specifically, the proportion of endpoints employing hardware-backed attestation—within the Business Responsibility and Sustainability Report (BRSR) framework, thereby transforming currently voluntary hygiene metrics into auditable compliance items. Second, enterprise CISOs should institute a "security triage cascade" whereby access privileges are dynamically recalibrated based on real-time threat telemetry from the National Critical Information Infrastructure Protection Centre (NCIIPC), rather than relying on static, policy-based access controls inherited from the pre-pandemic era. Third, given the pronounced sectoral heterogeneity, the Reserve Bank of India (RBI) and the Insurance Regulatory and Development Authority of India (IRDAI) should collaborate to design sector-specific cyber-insurance premium differentials that penalize firms with demonstrably weak remote-access governance, thereby incentivizing ex-ante investments in network segmentation.

Several boundary conditions circumscribe these conclusions. The reliance on self-reported CERT-In disclosures introduces potential underreporting bias, particularly among smaller entities lacking forensic capabilities. Moreover, the temporal window captures only the acute phase of the pandemic; the persistence of these effects is yet to be established. Future research should exploit the staggered reopening of Indian states in 2021–22 to implement a difference-in-differences design that distinguishes permanent architectural shifts from transitory pandemic-induced adaptations. Methodologically, the incorporation of unstructured textual data from employee communication platforms via natural language processing could illuminate the micro-mechanisms of security fatigue, thereby enriching our understanding of human-factor vulnerabilities in distributed work environments.

Anbalagan, D. (2017). New Technological Changes In Indian Banking Sector. International Journal of Scientific Research and Management. https://doi.org/10.18535/ijsrm/v5i9.11

Aras, G. (2015). Corporate and Capital Market Governance in Emerging Economies. Emerging Markets Finance and Trade. https://doi.org/10.1080/1540496x.2014.998932

Armitage, S., Hou, W., Sarkar, S., & Talaulicar, T. (2017). Corporate governance challenges in emerging economies. Corporate Governance: An International Review. https://doi.org/10.1111/corg.12209

Ayuso-Siart, S., & Argandoña, A. (2009). Responsible corporate governance: Towards a stakeholder board of directors?. Corporate Ownership and Control. https://doi.org/10.22495/cocv6i4p1

Behl, A., & Pal, A. (2016). Analysing the Barriers towards Sustainable Financial Inclusion using Mobile Banking in Rural India. Indian Journal of Science and Technology. https://doi.org/10.17485/ijst/2016/v9i15/92100

Bozec, R. (2013). Board independence and firm performance: a contingency model based on shareholders' proximity to management. International Journal of Corporate Governance. https://doi.org/10.1504/ijcg.2013.060476

Cambrea, D. R. (2019). Book review: “Corporate governance in emerging economies: Theory and practice”. Corporate Board role duties and composition. https://doi.org/10.22495/cbv15i3art6

Crittenden, V. L., & Crittenden, W. F. (2012). Corporate governance in emerging economies: Understanding the game. Business Horizons. https://doi.org/10.1016/j.bushor.2012.07.002

Fernandez, C., & Arrondo, R. (2005). Alternative Internal Controls as Substitutes of the Board of Directors. Corporate Governance: An International Review. https://doi.org/10.1111/j.1467-8683.2005.00476.x

Gove, S. (2010). Corporate Governance and Organizational Life Cycle: The Changing Role and Composition of the Board of Directors – By Olivier P. Roche. Corporate Governance: An International Review. https://doi.org/10.1111/j.1467-8683.2010.00825.x

Grove, H., Clouse, M., & Xu, T. (2020). Benchmarking boards of directors for better corporate governance. Corporate Board role duties and composition. https://doi.org/10.22495/cbv16i2art1

Kaur, S. (2020). Social and financial performance of Indian banking sector. International Journal of Public Sector Performance Management. https://doi.org/10.1504/ijpspm.2020.109301

Kchouri, B., El Gammal, W., Trabelsi, S., & El Kassar, A. N. (2018). Corporate governance in Lebanese banks: focus on board of directors. International Journal of Corporate Governance. https://doi.org/10.1504/ijcg.2018.10015591

Kulkarni, A. (2012). Towards Financial Inclusion in India. Prajnan: Journal of Banking and Financial Management. https://doi.org/10.1177/0970844820120307

Kumar, P., & Zattoni, A. (2014). Corporate Governance, Board of Directors, and the Firm: A Maturing Field. Corporate Governance: An International Review. https://doi.org/10.1111/corg.12082

Lee Jong-Moon (2008). A Study on Russian banking sector reform and performance during the Putin Era. The Korean Journal of Slavic Studies. https://doi.org/10.17840/irsprs.2008.24.2.002

Malhotra, M. S., & Kaur, G. (1992). Impact of Monetary Policy on the Profitability of Commercial Banks in India. Artha Vijnana: Journal of The Gokhale Institute of Politics and Economics. https://doi.org/10.21648/arthavij/1992/v34/i1/116103

Melkumov, D., Breit, E., & Khoreva, V. (2015). Directors' Social Identifications and Board Tasks: Evidence from <scp>F</scp>inland. Corporate Governance: An International Review. https://doi.org/10.1111/corg.12088

Mohanty, B., & Sarkar, S. (2019). Factors Contributing to Profitability of Select Commercial Banks in India: An Empirical Study. The Management Accountant Journal. https://doi.org/10.33516/maj.v54i7.98-102p

Mohapatra, P. (2016). Board independence and firm performance in India. International Journal of Management Practice. https://doi.org/10.1504/ijmp.2016.077834

Patel, D. J. (2018). Study of Profitability Ratios of Nationalized Banks and Private Banks Operating in India. International Journal of Trend in Scientific Research and Development. https://doi.org/10.31142/ijtsrd18425

Pathan, S., & Fulwari, A. (2020). BANKING SECTOR ORIENTED FINANCIAL INCLUSION IN INDIA: A LONG TERM PERSPECTIVE. Towards Excellence. https://doi.org/10.37867/te120205

Saha, M. (2018). Financial Performance of selected Units in Indian Power Sector: A Comparative analysis. Asian Journal of Research in Banking and Finance. https://doi.org/10.5958/2249-7323.2018.00004.4

Saini, N. (2014). /Measuring The Profitability And Productivity Of Banking Industry: A Case Study Of Selected Commercial Banks In India. Prestige International Journal of Management &amp; IT - Sanchayan. https://doi.org/10.37922/pijmit.2014.v03i01.005

Sangwan, S. S. (2017). Implementation and Impact of Financial Inclusion in India: Village Studies in Punjab &amp; Haryana. Prajnan: Journal of Banking and Financial Management. https://doi.org/10.1177/0970844820170104

Sarkar, S. S., & Phatowali, A. (2012). Financial Inclusion in Urban India: A Study in the State of Assam. Prajnan: Journal of Banking and Financial Management. https://doi.org/10.1177/0970844820120402

Sidhu, K. (2008). Die Regelung zur Compliance im Corporate Governance Kodex. Zeitschrift für Corporate Governance. https://doi.org/10.37307/j.1868-7792.2008.01.07

Sokang, K., & Ratanak, N. (2018). Capital Structure, Growth and Profitability: Evidence from Domestic Commercial Banks in Cambodia. INTERNATIONAL JOURNAL OF MANAGEMENT SCIENCE AND BUSINESS ADMINISTRATION. https://doi.org/10.18775/ijmsba.1849-5664-5419.2014.51.1004

Subramanian, V. G. (2014). Pension Reform in India: The Unfinished Agenda. Prajnan: Journal of Banking and Financial Management. https://doi.org/10.1177/0970844820140105

Tobe, C. (2000). Mutual Fund Directors: governance changes proposed for independent directors in the US. Corporate Governance: An International Review. https://doi.org/10.1111/1467-8683.00177

Van den Berghe, L. A. A., & Levrau, A. (2004). Evaluating Boards of Directors: what constitutes a good corporate board?. Corporate Governance: An International Review. https://doi.org/10.1111/j.1467-8683.2004.00387.x

Wang, Y., & Young, A. (2010). Does firm performance affect board independence?. Corporate Board role duties and composition. https://doi.org/10.22495/cbv6i2art1