Nobody in your finance team decided to break the law this morning. Somebody just needed a PDF editor fast, found a “free” download, and installed it without asking IT.
That’s how it usually starts. At Team Computers, we manage endpoint fleets for 250+ customers, and unlicensed software rarely shows up as a deliberate decision. It shows up as a shortcut — a cracked copy of Photoshop on a designer’s laptop, an unlicensed AutoCAD seat nobody renewed, a “free” Windows activation tool someone ran two years ago and forgot about. The legal exposure that follows doesn’t care how it got there.
Key Takeaways
- In 2026, 57% of software installed in emerging markets including India remains unlicensed, and India now ranks third globally among unlicensed-software hotspots.
- Under Section 63B of India’s Copyright Act, 1957, knowingly using an infringing copy of software carries up to 3 years’ imprisonment and a fine up to ₹2 lakh — per offence, per device.
- 87% of cracked software samples now contain malware, up from 72% in 2024.
- Company directors, not just the employee who installed it, can face personal criminal liability for unlicensed software running on company infrastructure.
How Common Is Pirated Software on Company Computers, Really?
In 2026, more than half of all software installed on business computers in India is unlicensed, which means the odds are your organization has exposure somewhere in the fleet even if IT has never flagged it. Industry tracking puts the figure at 57% of software in emerging markets including India, and separate compliance-intelligence data shows India has climbed to third place globally among countries with the highest unlicensed-software usage, behind only China and Russia.
This isn’t a small-business problem that large enterprises have outgrown. It’s a visibility problem. Unlicensed software rarely enters through a deliberate procurement decision — it enters through a browser extension, a “student edition” installed on a work laptop, or a vendor-supplied machine that arrived pre-loaded with software nobody audited.
Our observation: When we run asset audits during onboarding, unlicensed or mismatched software licenses are one of the two or three most common findings — right alongside missing endpoint protection. It’s almost never intentional. It’s almost always undocumented.
Also Read: What is Cybersecurity?
What Does Indian Law Actually Say About Using Pirated Software?
Under Section 63B of the Copyright Act, 1957, any person who knowingly uses an infringing copy of a computer program on a computer commits a criminal offence — not just the person who distributes it. The penalty is imprisonment for a minimum of seven days, extendable up to three years, along with a fine ranging from ₹50,000 to ₹2,00,000. This applies per infringing installation, which means a single unlicensed application running across twenty machines is not one violation — it’s a pattern that scales the company’s exposure with every device.
Section 63 of the same Act covers the broader offence of infringing or abetting infringement of copyright, carrying a minimum six-month sentence extendable to three years, with the same fine range, and Section 63A adds enhanced penalties for repeat offences. Crucially, “knowingly” is the operative word courts examine — but ignorance at the individual-employee level rarely protects the organization once IT or management should reasonably have known unlicensed software was in use across company assets.
For a business, criminal exposure runs alongside civil liability. Copyright holders can pursue injunctions, damages, and accounts of profits under the Act’s civil remedies, and software vendors increasingly use telemetry and audit data — not manual detection — to identify unlicensed use inside Indian enterprises before ever filing a claim.
Who Is Actually Liable When an Employee Installs Pirated Software?
The employee who clicked “install” is rarely the only one exposed — under Indian law, liability for unlicensed software running on company infrastructure can extend to the organization and, in some circumstances, to the directors or officers responsible for IT governance. Courts examining these cases look at whether management knew, or should reasonably have known, that unlicensed software was in use on assets the company owns and controls.
That’s precisely why “the employee installed it without asking” is a weak defense in an audit or litigation context. It demonstrates a governance gap — no asset inventory, no software approval process, no license tracking — rather than an absence of company responsibility. Vendors and industry bodies running license-compliance programs in India have specifically shifted toward telemetry-based detection and pre-litigation settlement offers, which means many companies first learn about an exposure through a letter, not a raid.
Why this is changing in 2026: Compliance enforcement in India is moving from occasional physical audits to continuous, data-driven detection. Software vendors can now identify unlicensed activations remotely, which means the “we’ll never get caught” assumption behind a lot of shadow IT no longer holds.
Beyond the Law: What’s the Security Risk of Pirated Software?
Even if legal exposure weren’t a factor, pirated software is now one of the most reliable ways to hand an attacker a foothold inside your network. In 2026, 87% of cracked software samples analyzed contained malware, up sharply from 72% just two years earlier, and businesses running pirated software are roughly five times more likely to experience a data breach than those on licensed, vendor-supported installations.
The mechanics are straightforward: cracked software requires disabling license verification, which often means disabling the update mechanism and security checks along with it. That leaves the machine permanently unpatched, unable to receive vendor security fixes, and running an installer that may already have delivered a Trojan, cryptominer, or credential-stealing payload during setup. A landmark Microsoft-commissioned study found that 92% of new, unused computers pre-loaded with pirated software were already infected with malware before the buyer ever turned them on — the infection wasn’t something the employee caused. It was baked in.
For a business, this converts a licensing problem into an incident-response problem: the same unpatched, unmonitored machine that exposes you to a copyright claim is also the machine least likely to be caught by your EDR before an attacker moves laterally.
How Should Businesses Audit for Unlicensed Software?
A defensible position starts with knowing what’s actually installed across every managed device — not what procurement records say should be there, since those two lists rarely match by the time a fleet has grown past a few dozen machines. Software asset management (SAM) tooling can reconcile installed applications against purchased licenses automatically, flagging mismatches before an external audit does.
A practical audit checklist covers:
- [ ] Full software inventory across every managed endpoint, including personally-owned BYOD devices with company access
- [ ] Reconciliation of installed applications against active license counts and expiry dates
- [ ] Application allowlisting so unapproved installers can’t run without IT sign-off
- [ ] A documented software request and procurement process employees can actually use — the fastest way to stop shadow IT is to make the legitimate path faster than the pirated one
- [ ] Quarterly reconciliation, not an annual scramble before a vendor audit letter arrives
- [ ] Clear removal and remediation workflow the moment unlicensed software is found
How Team Computers Helps You Eliminate This Risk
Closing this gap isn’t just a policy memo — it needs the same endpoint visibility and control that stops malware in the first place, which is exactly where Team Computers operates. Alongside next-gen antivirus, XDR/EDR, and patch management, our endpoint security practice gives IT teams the asset visibility to see what’s actually installed across every managed device, not just what procurement is expected to be there.
Backed by 25+ OEM partnerships and 21+ dedicated certified engineers supporting 250+ customers with 24/7 coverage, we help organizations move from “we hope everything’s licensed” to a documented, auditable answer — the kind that holds up whether the question comes from a software vendor’s compliance team or your own board.
Frequently Asked Questions
Can a company be held liable if an employee installs pirated software without permission?
What's the actual penalty for using pirated software in India?
Section 63B of the Copyright Act, 1957 sets a minimum sentence of seven days' imprisonment, extendable up to three years, plus a fine between ₹50,000 and ₹2,00,000 — per person, per infringing use. Section 63 covers broader infringement with a minimum six-month sentence, and Section 63A increases penalties for repeat offences.
Is it really unlicensed if we bought one license and installed it on multiple computers?
Yes, in most cases. Standard commercial software licenses are tied to a specific number of installations or users. Installing beyond the licensed count — even with a legitimately purchased original license — is a form of unlicensed use that vendors' compliance programs are specifically designed to detect through telemetry.
How do software vendors actually catch unlicensed use?
Increasingly through telemetry rather than physical audits. Modern software can report activation and usage patterns back to the vendor, letting compliance teams identify unlicensed installations remotely and issue pre-litigation notices or settlement offers before a formal claim is filed.
Does antivirus software protect against malware bundled in pirated software?
Not reliably. Cracked software typically disables update and license-verification mechanisms to work at all, which often disables security checks in the same process. Malware embedded in the installer can execute before antivirus definitions catch up, and a machine running cracked software stops receiving vendor security patches entirely — leaving it exposed regardless of what endpoint protection is layered on top.
