The stereotype is twenty years out of date. What the industry now consists of, why global capability centres are the real story, how NASSCOM and the Economic Survey disagree on the numbers and why that matters, the tier-2 city shift, why Indian firms themselves outsource to the Philippines, and how to verify a vendor using public Indian company records.
Is Outsourcing to India a Security Threat? Model the Access
“Is country X a threat” is not a threat model. What drives risk in an outsourcing deal is third-party access design, jurisdiction and vendor control maturity. What the Verizon DBIR third-party figure really measures, what the DOJ bulk data rule says, what DPDP and CERT-In require of your vendor, and the control set that works regardless of geography.