AAA Technologies Ltd Management Discussions

1. Overview

Incorporated in October 2000 as "AAA Technologies Private Limited" under the Companies Act, 1956 in Maharashtra, our company was later converted into a Public Limited Company on August 3,2020.

AAA Technologies is an Information Technology and Information Security Auditing & Consulting firm, enabling organizations to strengthen corporate governance in a digital environment. We help clients identify risks within their information systems and implement controls to secure critical assets. Our core services include Information Systems Audit, Cyber Security, IT Assurance & Compliance, Information Security, and IT Governance.

We cater to a wide client base across the BFSI sector. Government bodies, Regulatory Agencies, Public Sector Units, and private enterprises. The company is led by seasoned professionals like Mr. Anjay Agarwal (39+ years of experience) and Mr. Venugopal Dhoot (39+ years of experience). These experts bring strategic direction and deep industry insight.

To procure business from government and public sector organizations, we actively participate in tenders floated for CERT-In empanelled IT security firms and are empanelled with NICSI under the Ministry of Electronics and Information Technology (Meitv). We are also listed with multiple government entities, PSUs, and banks, enabling direct procurement of services.

Staying focused on Information Security Auditing & Consulting, AAA Technologies has developed capabilities across a wide range of audit domains, such as operating systems, network infrastructure, intrusion detection systems, web applications, ERP, ATM systems, core banking, digital forensics, and cybercrime investigations.

Our diverse experience spans a wide array of sectors: banking, insurance, NBFCs, regulatory bodies, government institutions, municipalities and panchayats, payment gateways, stockbroking, education, transport, hospitality, manufacturing, IT & ITeS, ports, energy, trading corporations, entertainment, defense, and refineries. This sector-agnostic approach ensures business continuity without dependence on any single industry.

We are ISO 9001:2015 and ISO 27001:2022 certified, backed by a competent team that ensures timely delivery, proactive threat identification, and actionable solutions to mitigate risks.

2. Industry, Structure, and Development of the Economy Global Economy

The global economy in 2026 is expected to remain resilient but uneven, with growth moderating from recent levels and influenced by trade tensions, geopolitical risks, inflation dynamics, and technology-led investment. The IMF projects global growth at 3.0% in 2026 and 3.4% in 2027, while the World Bank and UNCTAD are somewhat more cautious, both pointing to growth closer to the 2.5%-2.7% range for 2026.

https://www.imf.org/en/publications/weo/issues/2026/07/08/world-economic-outlook-update-july-2026

https://www.worldbank.org/en/news/press-release/2026/0l/l3/global-economic-prospects-january-2026-press-release

https://openknowledge.worldbank.org/entities/publication/e96798d7-a81d-44ea-8287-lb4d6ea83f75

Key points:

The IMFs July 2026 update says global growth is projected at 3.0% in 2026, with Al-related demand supporting countries integrated into the technology value chain, while renewed conflict and financial market repricing remain downside risks.

https://www.imf.org/en/publications/weo/issues/2026/07/08/world-economic-outlook-update-july-2026

https://www.imf.Org/-/media/files/publications/weo/2026/update/july/english/text.pdf

The IMFs January 2026 update had been more optimistic, projecting 3.3% growth in 2026, supported by technology investment, fiscal and monetary support, and accommodative financial conditions.

https://www.imf.org/en/publications/weo/issues/2026/0l/l9/world-economic-outlook-update-january-2026

The World Banks June 2026 outlook is more subdued, projecting global growth at 2.5% in 2026, citing the impact of conflict-driven energy price increases and weaker per capita income growth in emerging markets.

https://openknowledge.worldbank.org/entities/publication/e96798d7-a81d-44ea-8287-lb4d6ea83f75

UNCTAD expects the global economy to slow to 2.7% in 2026, with trade tensions, fiscal strains, and uncertainty weighing on investment and momentum.

https://unctad.org/publication/world-economic-situation-and-prospects-2026

Inflation is generally easing globally, but the pace is uneven, and the IMF notes that disinflation has stalled in some regions.

https://www.imf.org/en/publications/weo/issues/2026/07/08/world-economic-outlook-update-july-2026

https://www.imf.Org/-/media/files/publications/weo/2026/update/july/english/text.pdf

In short, the outlook is not recessionary, but it is fragile and regionally uneven, with stronger performance likely in economies linked to technology investment and weaker outcomes in energy-importing and highly exposed emerging markets

Indian Economy

The Indian economy continues to demonstrate strong resilience, supported by robust domestic demand, steady investment activity, and ongoing policy reforms. While growth is expected to moderate moderately from recent highs, India is likely to remain one of the fastest-growing major economies in the world. Near-term outlooks suggest GDP growth in the range of 6.5% to 7.3%, with inflation remaining broadly manageable, though subject to external risks such as commodity price volatility, geopolitical tensions, and global trade uncertainties.

Sectoral Boosts:

Government initiatives are providing a strong sectoral boost to the IT security audit and assurance industry in India. Regulatory bodies and agencies such as CERT In and sector specific CSIRTs are increasingly mandating periodic security audits, vulnerability assessments and cyber resilience reviews, particularly across critical sectors including banking and financial services, power, transport and other essential services. Enhanced budgetary allocations for cyber security, tighter compliance requirements, and the growing emphasis on independent assurance for government and public sector systems are collectively expanding the addressable market for specialised IT security audit, VAPT and IT governance services. This regulatory momentum is expected to drive sustained demand for credible, independent cyber security audit providers over the medium term.

Position on the Global Stage

India continues to strengthen its position as one of the worlds most resilient and dynamic major economies. Despite global headwinds, including trade uncertainty, geopolitical tensions and volatility in financial markets, India is expected to remain the fastest-growing large economy, supported by strong domestic demand, structural reforms, and sustained public and private investment. With improving macroeconomic fundamentals, expanding global integration and a growing role in international trade and services, India is well positioned to play an increasingly important role in the global economic landscape.

Cyber Security Industry Overview

The global cyber security industry is in a structural growth phase, supported by the rapid digitalisation of businesses and governments, proliferation of cloud and mobile technologies, and the rising frequency, scale and sophistication of cyber attacks. Cyber risk is now widely recognised as a core enterprise risk, prompting boards and regulators to demand stronger controls, independent assurance and demonstrable compliance with evolving standards.

Spending on cyber security products and services is expanding across geographies and sectors, with particularly strong momentum in financial services, government, critical infrastructure, healthcare and technology driven businesses. Regulatory and policy initiatives - including data protection laws, sector specific cyber security directives, incident reporting obligations and mandatory security audits - are further catalysing demand for robust information security frameworks and periodic third party reviews.

Within this landscape, assurance led offerings such as Information Systems (is) Audit, cyber security and IT security audits, IT governance reviews. Vulnerability Assessment and Penetration Testing (VAPT), configuration and compliance reviews, and specialised regulatory audits are gaining prominence. Organisations are increasingly seeking independent, specialist partners to validate the effectiveness of their controls, identify vulnerabilities, benchmark security maturity and support remediation.

As a niche, domain focused player in information systems audit and cyber security assurance, AAA Technologies is well positioned to benefit from these industry tailwinds. The Companys specialised service portfolio, technical expertise and experience across diverse regulatory environments enable it to address the growing need for credible, independent cyber security and IT audit services in India and, over time, in select international markets.

According to report "India Cyber Security Domestic Market 2023" by DSCI„ the India Cybersecurity market grew at a CAGR of over -30% during 2019-2023 to reach USD 6.06 billion in 2023. India Cybersecurity market accounted by -3% of the overall global cybersecurity market. It is expected to account for 5% of the global market by 2028.

Cyber Wars

The increasing geopolitical use of cyber tools has given rise to so called "cyber wars", where state and state sponsored actors target critical infrastructure, financial systems, government networks and key private enterprises through sophisticated digital attacks.

Such activities, which often blur the lines between crime, espionage and warfare, heighten systemic cyber risk and underscore the need for robust security architectures, continuous monitoring and independent assurance. For organisations, this evolving threat landscape reinforces the strategic importance of cyber resilience, regulatory compliance and specialist information security audits as integral components of overall risk management. Medium Term Strategic Objectives

Employee Training and Development:

The Company recognises that its people are its most important asset and that continuous learning is critical in a rapidly evolving technology and regulatory environment. During the year, we continued to invest in structured training and development initiatives aimed at enhancing both technical and behavioural competencies.

Our programmes covered specialised areas such as information systems audit, cyber security, VAPT, regulatory and compliance frameworks, data protection, as well as soft skills including communication, leadership and project management. Employees were encouraged to pursue relevant professional certifications, with the Company providing support through sponsorships, study leave and access to learning resources.

These initiatives are designed not only to keep our teams abreast of emerging technologies, standards and threats, but also to strengthen our execution capabilities and service quality. By fostering a culture of continuous improvement and knowledge-sharing, the Company seeks to build a high performing, future ready workforce aligned with its long term growth objectives.

Compliance and Regulatory Expertise:

The Company places strong emphasis on compliance with applicable laws, regulations, standards and contractual obligations, recognising that robust governance is fundamental to sustaining stakeholder confidence. Over the years, we have developed specialised expertise in interpreting and implementing complex regulatory requirements relating

to information systems, data protection, cyber security and IT governance, including those prescribed by regulators such as RBI, SEBI and other sectoral authorities, as well as under the Information Technology Act and allied guidelines. This regulatory understanding is embedded into our service offerings, enabling us to assist clients in aligning their technology environments with mandated frameworks, industry best practices and emerging compliance expectations. Our teams remain abreast of evolving regulatory developments through continuous training, active participation in professional forums and close engagement with industry bodies. By combining technical proficiency with strong regulatory insight, the Company delivers assurance and advisory services that help clients strengthen their control environments, mitigate compliance risks and enhance overall governance standards.

Cybersecurity Awareness Programs:

The Company recognises that people are a critical line of defence in managing cyber risk. Accordingly, we place strong emphasis on cybersecurity awareness programs designed to educate employees on emerging threats, safe digital practices, phishing identification, data protection, incident reporting and compliance obligations. These initiatives are conducted on a regular basis through role-based training, simulations and periodic refreshers to reinforce secure behaviour across the organisation. By fostering a culture of vigilance and accountability, the Company aims to strengthen its overall cyber resilience and support the protection of sensitive information assets.

Investment in Al-Driven Security Tools:

Recognising the growing sophistication and volume of cyber threats, the Company is progressively integrating Al driven tools into its audit and cyber security assurance processes. These technologies enhance our ability to analyse large datasets, detect anomalies, prioritise vulnerabilities and generate more timely, data driven insights for clients. By selectively adopting Al enabled platforms in areas such as log analytics, threat intelligence and vulnerability assessment. AAA Technologies aims to improve the depth, efficiency and consistency of its service delivery, while reinforcing its positioning as a specialised, technology led provider of independent cyber security and IT audit services.

Alliances & Partnership

The Company recognises that strategic alliances and partnerships are key levers for enhancing capabilities, accessing advanced technologies and expanding market reach. During the year, we continued to deepen our engagement with leading technology vendors, niche solution providers, industry associations and professional bodies in the domains of information systems audit, cyber security and IT governance.

These alliances facilitate access to specialised tools and platforms, contemporary methodologies and sector specific insights, enabling the Company to deliver more comprehensive, value added solutions to clients. Collaborative initiatives included joint knowledge sharing programmes, participation in industry forums, co branded thought leadership and cooperative engagements on complex assignments where complementary skills were required.

The Company intends to further strengthen and selectively expand its network of partnerships in a prudent manner, with a focus on relationships that support innovation, service differentiation and entry into new client segments and geographies. Through this calibrated approach, alliances and partnerships are expected to remain an integral pillar of the Companys long term growth and capability building strategy.

The Company serves or has served various Companies/ Institutions across various industries like banking, insurance. Financial Institutions, NBFCs, Regulatory Bodies, Government, Municipalities Corporations, Payment Gateways, Stock Brokers, Education, Travel and Transport, Hospitality, Manufacturing and Engineering, Infrastructure, Healthcare, Information Technology, IT Enabled Services (iTeS), Ports, Power, Trading Corporations, Entertainment, E-Tendering, Defence and refineries and many more. The company currently onboard PSU banks such as SBI, Bank of Baroda, Central Bank of India, Bank of India, etc

SWOT analysis

Strengths

• Niche focus on Information Systems Audit, Cyber Security and IT Governance with long-standing domain expertise

• Asset light, debt free balance sheet and prudent financial management

• Empanelment with key government and public sector bodies, enhancing credibility and access to large assignments

• Diverse client base across sectors, reducing dependence on any single client or industry

• Experienced leadership team and qualified professionals with relevant certifications

Weaknesses

• Relatively modest scale of operations compared to larger domestic and global peers

• Revenue concentration in project / tender based assignments, leading to potential variability in quarterly performance

• Limited international presence and brand visibility outside core markets

• Dependence on availability and retention of specialised talent in a highly competitive skills market

Opportunities

• Structural increase in demand for cyber security, IT audit and compliance led assurance services driven by digitalisation and rising cyber threats

• Growing regulatory and policy focus on data protection, IT governance and mandatory security audits across sectors

• Increasing adoption of advanced technologies (cloud, Al. digital public infrastructure) requiring specialised assurance and governance reviews

• Scope to expand service offerings, deepen client relationships and selectively enter new geographies and industry segments

Threats

• Intensifying competition from larger consulting firms, IT service providers and emerging niche players, potentially putting pressure on pricing and margins

• Rapidly evolving technology and threat landscape requiring continuous upskilling and investment in tools and methodologies

• Changes in regulatory frameworks, empanelment criteria or government procurement policies that may impact business volumes

• Cyber incidents, data breaches or service delivery lapses within the ecosystem that could affect reputation and client confidence in service providers

Government Regulations and Initiatives

The Government of India continues to accelerate its digital infrastructure and cyber resilience agenda in FV 2024-25.

With a marked rise in cyber threats, both at the national and organizational levels, there is increased focus on IT audit. regulatory compliance, and cyber security preparedness has become sharper than ever.

Increased Budgetary Allocation:

The Union Budget 2024-25 has allocated increased funds for digital security infrastructure, particularly supporting public sector digital initiatives. The Union Budget 2025 has allocated over S1.900 crore for cybersecurity initiatives. marking an 18% increase from the previous budgets allocation of ?1,600 crore.

Reference:

https://www.frost.com/uncategorized/union- budget-2025-prioritizes-cybersecurity-amid-rising-threats/#:~:text=ln% 20response7o2C7o20the7o20Union7o20Budget,allocation7o20of7o20%E2%827oB91?/=2C6007=20crore.

DPDP Act Implementation Push:

Following the enactment of the Digital Personal Data Protection (DPDP) Act, 2023, FY 2024-25 is witnessing its active rollout. Organizations across sectors are working toward aligning with the Acts mandates, including data classification, privacy governance, and breach notification.

Under the Digital Personal Data Protection (DPDP) Act, organizations must uphold core data protection principles. Data must be collected only for specific, clear, and lawful purposes with the individuals explicit consent. The collection should follow the principle of data minimization, only information essential for the stated purpose should be gathered. Once the intended objective is achieved, the data must be securely deleted in line with storage limitation norms. Above all, organizations are held accountable and must demonstrate compliance with these obligations, ensuring transparency and responsibility at every stage of data processing.

The DPDP Act imposes steep fines to deter negligence:

Breach Type	Penalty (iNR - Up To)
Failure to take reasonable security safeguards to protect from a breach	3250 Crore
Failure to give notice upon breach of personal data	3200 Crore
Breach of obligations owed to children	3200 Croro
Breach of obligations of Significant Data Fiduciaries	3150 Crore
Breach of consent obligations	350 Crore
Breach of any other provision	350 Croro

The Act is catalyzing widespread investment in audit-readiness and privacy-enhancing technologies, creating a need for professional audit partners like us. (Reference)

Sector-Specific Regulatory Moves:

• RBIs Master Direction (Nov 2023) on IT governance is now in force, making cyber audits and compliance assurance a regulatory necessity for banks, NBFCs, and other financial entities.

• IRDAIs Cyber Security Guidelines (2023) are being implemented across the insurance sector with a focus on perimeter security, cloud controls, and real-time threat detection, further opening avenues for specialized IT audit support.

Ongoing Strategic Initiatives:

Flagship national programs such as Cyber Surakshit Bharat, I4C (Indian Cybercrime Coordination Centre), and the National Cyber Security Exercise (NCX) continue to receive policy and infrastructural backing in FY 2024-25.

Additionally, the establishment of the National Facility for Security Testing of loT Devices is now transitioning into its operational phase, further formalizing certification-led audit ecosystems.

Favourable Market Sentiment:

According to recent reports, over 81% of Indian enterprises cite regulatory compliance as their top driver for cybersecurity investment. For AAA Technologies, this boosts our addressable market driven by compliance urgency, digital maturity, and increasing penalties for governance lapses.

In this evolving landscape, our niche expertise in IT audits and regulatory compliance aligns seamlessly with national priorities, positioning us as a trusted partner in building Indias digital trust and cyber resilience.

3. Risk and Mitigation Strategy

1. Market Dependency Risk

Multiple factors have impacted the domestic and global economic conditions. Prolonged slowdown of economic growth can potentially reduce demand for IT audit services. This is because IT spending patterns have always been sensitive to global and economic conditions-

Mitigation:

We primarily serve government departments, PSUs, statutory bodies, and municipal corporations. This gives us a relative stability that is not impacted by volatile market cycles. Empanelment with state-level institutions and banks helps generate recurring work and buffers against market fluctuations.

2. Cybersecurity Risk

The nature of our services involves sensitive data management. This makes us increasingly susceptible to cyber threats like malware, ransomware, or data breaches. This risk is further intensified due to conditions like remote work exposure.

Mitigation:

We follow a Zero Trust Security model that enforces access control based on specific roles and devices. Our teams operate within clearly defined data access parameters, reducing the risk of internal or external breaches. We also limit contractual liability wherever feasible.

3. Talent Acquisition and Retention Risk

The industry demands highly skilled professionals within the IT and cybersecurity space. There is intense competition in the field for experienced auditors and cybersecurity experts. Thus creating an ongoing demand, but also a retention risk that can risk the business.

Mitigation:

We focus on employee wellbeing through a supportive work culture, secure infrastructure, and work life balance initiatives. Internal capability-building programs and competitive benefits help in retaining skilled personnel.

4. Technology Risk

The rapid evolution of technology sectors like cloud computing, Al, and big data. Older, obsolete tools and methods threaten the sanctity of business operations. This can impact service quality.

Mitigation:

Our internal tools are routinely upgraded to align with emerging technologies. We closely monitor industry trends and invest in new capabilities as needed to stay current and competitive.

5. Regulatory Compliance Risk

Non compliance with statutory requirements or failure to renew empanelments and certifications on time may impact our ability to bid or execute projects.

Mitigation:

A dedicated compliance team tracks the timeline and ensures all statutory registrations, empanelments, and certifications are renewed well in advance. This approach allows us to remain up to date with all our compliances.

6. Performance Guarantee Risk

Inability to furnish performance guarantees could hinder our chances of securing new contracts, particularly in public sector tenders.

Mitigation:

We maintain strong relationships with multiple banks to issue guarantees when needed. If limits are exhausted, we approach alternative financial institutions to ensure the continuity of bidding activity.

7. Client Concentration Risk

Over-reliance on a single or a few clients for a major portion of revenue can pose financial risk in case of contract discontinuation.

Mitigation:

Our client base spans across sectors and states. We work on medium-term contracts and enjoy high client retention through repeat engagements. Business development efforts are focused on onboarding new clients to reduce dependence further.

8. Internal Control Risk

Weak internal controls could result in inaccurate reporting, fraud, or failure to manage operational risks effectively.

Mitigation:

We follow stringent internal processes and multi-level review mechanisms to maintain audit integrity. Our control systems are periodically reviewed and enhanced to stay ahead of emerging risks and regulatory requirements.

Internal Financial Control Systems and Their Adequacy

The Company has in place adequate internal financial controls commensurate with the size and nature of its operations. These controls have been designed to provide reasonable assurance regarding the accuracy and reliability of financial reporting, the safeguarding of assets, the orderly and efficient conduct of business, and compliance with applicable laws and regulations. The internal control framework includes well defined policies and procedures, appropriate segregation of duties, clearly laid down authority and approval matrices, and robust systems for recording, processing and reporting financial transactions.

The effectiveness of internal financial controls is reviewed on a periodic basis through management oversight, internal audits and review of key reconciliations and control accounts. Identified control gaps, if any, are addressed through corrective and preventive measures in a timely manner. Based on the review and evaluations carried out during the year, the Board is of the opinion that the Companys internal financial controls over financial reporting were adequate and operating effectively as at the reporting date.

Our Internal Auditor conducts regular audits and reports any lapses to the management. These findings are submitted periodically to the Board of Directors for their review and feedback. The presence of a professional and experienced Board, as outlined in the Corporate Overview section, further strengthens internal oversight.

Additionally, the Audit Committee periodically evaluates the adequacy and effectiveness of the internal control systems and recommends improvements in response to evolving business dynamics. Continuous upgrades to systems and processes are made through automation, adoption of best practices, and the deployment of modern IT tools.

Developments in Human Resources

At AAA Technologies Limited, we firmly believe that our people are our most valuable asset. Our Human Resource Management (hrm) initiatives aim to not only attract and retain top talent but also foster a culture of continuous learning and innovation. During FY 2025-26, we concentrated on the following key HR areas:

Talent Acquisition and Development.

Talent Acquisition and Development

We continued to recruit professionals who not only bring relevant skills but also resonate with our core values. Our targeted hiring strategies and rigorous evaluation processes have strengthened the team with dynamic and diverse talent.

Employee Engagement and Well-being

We prioritised employee well-being by implementing wellness programs, offering flexible work arrangements, and enabling professional development. These efforts aim to create a positive, fulfilling work environment.

Performance Management

Our performance evaluation system has been upgraded to ensure clarity of expectations, ongoing feedback, and career development. This helps align individual goals with the organizations strategic direction.

Diversity, Equity, and Inclusion (DEl)

We are committed to building an inclusive workplace where every individual is respected and valued. Steps have been taken to improve diversity at all levels and ensure equal opportunities for all employees.

Leadership Development

Recognizing the critical role of leadership, we have invested in programs to empower managers with the tools and skills necessary to lead effectively, foster collaboration, and drive performance.

Looking ahead, we remain dedicated to evolving our HRM practices by investing in our people and nurturing a culture that promotes collaboration, innovation, and excellence.

Significant Changes

There were no significant changes in the Company during the financial year under review.

Cautionary Statement

This Management Discussion and Analysis contains forward-looking statements that are subject to risks and uncertainties. Actual results may differ materially from those expressed or implied due to various factors, including changes in economic and political conditions, technological advancements, regulatory developments, and other risks detailed in our regulatory filings. The Company assumes no obligation to update these forward-looking statements.