5 min readNov 11, 2026 03:54 PM IST First published on: Nov 11, 2026 at 03:54 PM ISTThe Nvidia episode, in which the company’s chief executive is alleged to have been cultivated through a personal relationship by an individual US authorities assessed as a Chinese intelligence asset, does more than expose one firm to scrutiny. It reveals a structural feature of contemporary strategic competition that Indian corporate governance has yet to treat as ordinary. The method does not require dramatic intrusion. It proceeds through the dense, ordinary networks of commercial life — travel, partnerships, conferences, recruitment, and personal association — precisely because the knowledge that now matters most resides inside private organisations rather than state laboratories.Indian boards have grown accustomed to registering geopolitical risk as a set of external constraints: Tariff changes, export controls, supply-chain concentration, or sudden regulatory shifts in major markets. These remain real, but they do not exhaust the problem. Once advanced process knowledge, design data, and the tacit expertise of key individuals become instruments of national power, foreign intelligence services have a rational interest in reaching those individuals and the organisations that employ them. The precedents are clear enough. Yanjun Xu’s overtures to GE Aviation employees through academic and professional channels, and Walter Liew’s use of former DuPont personnel to obtain titanium dioxide technology succeeded not by overcoming high walls but by exploiting the ordinary permeability of global business.AdvertisementAlso Read | The AI race has a democracy problemIndia’s exposure is distinctive because of the pace and character of its own ambitions. As firms expand in semiconductors, AI, aerospace components, telecommunications, and advanced manufacturing, they accumulate the capabilities that larger powers treat as strategic. The government’s own public warnings that India’s rising design and manufacturing capacity will be viewed as a threat, and that industry should prepare for cyber and other disruptions, already acknowledge this. What has not followed with equal clarity is an institutional response inside companies.Most Indian boards still lack a settled practice for assessing which executives, engineers, or researchers constitute points of leverage; how overseas partnerships or customer relationships create observation opportunities; or how personal and professional networks can be turned to intelligence purposes. The functions that would need to cooperate — security, legal, human resources, and business development — continue to operate with limited shared visibility.This is not primarily a failure of technical cybersecurity. It is also the inability to recognise that the relevant perimeter has expanded to include people and relationships. In a firm whose competitive position rests on proprietary processes or data, the fiduciary responsibility of directors extends to understanding how that knowledge can be observed or extracted through non-technical means. Yet the vocabulary and routines of corporate risk management remain better adapted to financial controls, compliance checklists, and network security than to the quieter work of mapping exposure created by legitimate commercial activity. An unusual recruitment approach, a request for technical detail that exceeds the stated purpose of a meeting, or sustained interest in a particular employee may register as noise in one department and remain invisible to others. Viewed together, they can indicate systematic interest.AdvertisementThe Nvidia case illustrates the difficulty. Even in a company of exceptional scale and sophistication, the combination of a major customer relationship and a personal connection was sufficient to generate a national-security concern that required an independent board inquiry. Indian firms that are still building their positions in global value chains, and that often depend on foreign technology, capital, or markets, operate with thinner institutional buffers. Their key personnel travel more, their partnerships are newer, and their internal processes for handling sensitive information are frequently less compartmentalised. The same openness that enables growth also multiplies the surface available for cultivation.you may likeAddressing this does not require boards to mimic intelligence agencies. What they need to do is treat the targeting of people and knowledge as a standing category of material risk, subject to regular assessment and accountability. That means identifying the individuals and relationships that carry the highest exposure, incorporating relevant questions into partnership due diligence, and creating mechanisms by which dispersed signals can be assembled. The state has a parallel obligation: To furnish sector-specific assessments that companies can actually use, and to maintain channels through which suspicious approaches can be reported without converting ordinary commercial activity into a security regime. Industry associations can extend rudimentary practices to smaller suppliers that sit inside critical chains but lack dedicated capacity.The deeper vulnerability, then, is not that foreign services may attempt to reach Indian firms. It is that the institutions responsible for those firms have not yet adjusted their conception of risk to the fact that strategic knowledge now lives, and can be reached, inside the private sector. Until boards and the government treat that fact as ordinary rather than exceptional, the expansion of Indian capabilities will continue to outpace the arrangements required to protect them.The writer is part of the Indian Foreign Service. Views expressed in this article are strictly personal