AI IS TRANSFORMING CYBER ATTACKS AS WELL AS DEFENCES: WHAT THIS MEANS FOR INDIA

Why In News?

The Indian Computer Emergency Response Team (CERT-In) under the Ministry of Electronics and Information Technology (MeitY) issued a national high-severity advisory titled "Defending Against Frontier AI-Driven Cyber Risks" (CIAD-2026-0020), alerting government bodies, enterprises, and MSMEs about autonomous AI-enabled cyber threats. 

How is AI Transforming Cyber Attacks?

CERT-In warns that advanced AI systems can analyse large codebases, discover vulnerabilities, automate reconnaissance, generate convincing phishing content and help orchestrate multi-stage attacks.

Automated Vulnerability Discovery: Frontier AI models ingest massive software repositories in seconds, discovering hidden logic bugs, buffer overflows, and zero-day flaws faster than human security auditors. 

Automated Reconnaissance: AI web-crawlers map enterprise attack surfaces autonomously, scanning public repositories, exposed cloud buckets, and employee social profiles to find security gaps. 

Faster Exploit Development: Generative models generate functional exploit code and proof-of-concepts within minutes, collapsing the gap between vulnerability disclosure and active exploitation.

 AI-Generated Phishing: Produces contextually tailored, grammatically perfect spear-phishing emails that mimic authentic organizational communication styles. 

Deepfake-Based Impersonation: Synthesizes high-fidelity video and audio clones of executives, enabling Business Email Compromise (BEC) and bypass of voice biometric authentication.Automated Credential Theft: Machine learning algorithms optimize credential-stuffing campaigns, adjusting request intervals and rotating IPs to evade automated bot-detection systems. 

Malware Generation: Generates obfuscated and polymorphic malicious payloads that alter their binary signatures upon each deployment to defeat static antivirus scanners. 

Automated Multi-Stage Attacks: Autonomous agentic scripts execute multi-tier cyber operations—initial access, privilege escalation, lateral traversal, and data exfiltration—seamlessly. 

Adaptive Cyber Attacks: Malicious AI scripts probe defensive firewall rules dynamically, altering their payload structure in real time to avoid triggering intrusion prevention alerts. 

Why is AI Making Cyber Attacks More Dangerous?

Lower Entry Barrier for Attackers: Open-source generative tools enable novices with minimal technical skills to execute sophisticated, state-level cyber operations. 

Greater Speed: Offensive operations execute in milliseconds, leaving defenders zero margin for manual human intervention. 

Greater Scale: Attackers target thousands of organizations and millions of endpoints simultaneously without proportional resource costs. 

Personalised Attacks: AI mines social footprints to create customized lures targeting specific corporate roles and vulnerabilities. 

Multilingual Social Engineering: Generates flawless phishing lures in regional Indian languages (Hindi, Bengali, Tamil, Telugu), targeting non-English speaking digital users. 

Continuous Adaptation: Malware self-modifies its execution routines to bypass defensive barriers dynamically. 

Reduced Human Intervention: Autonomous attack pipelines execute end-to-end campaigns without manual supervision. 

Lower Cost of Cybercrime: Automation reduces the financial and operational expenditure required to sustain large-scale cyber offensive campaigns. 

How is AI Transforming Cyber Defence?

Automated Threat Detection: Ingests petabytes of network traffic in real time to spot malicious patterns instantly. 

Vulnerability Detection: Scans source code and cloud configurations continuously, identifying flaws before attackers discover them. 

Behavioural Analysis: Establishes baseline profiles of legitimate user behavior to detect unauthorized access and insider threats. 

Anomaly Detection: Identifies subtle deviations in data transfers, login locations, and API usage that indicate an ongoing breach. 

Threat Intelligence: Correlates global threat feeds, dark-web discussions, and attack telemetry to predict emerging campaigns. 

Automated Incident Response: Triggers automated containment protocols, isolating infected endpoints and revoking access tokens in milliseconds. 

Attack Surface Analysis: Continuously audits all internet-facing digital assets, identifying unpatched systems and shadow IT. 

Security Operations Automation (SOAR): Automates repetitive triage tasks, reducing alert fatigue for cybersecurity analysts. 

Predictive Cybersecurity: Anticipates potential attack vectors based on historical breach patterns, allowing proactive defense reinforcement.

 Why is India Particularly Vulnerable?

• Rapid Digitalisation: Rapid internet penetration and mobile adoption have expanded the digital footprint across tier-2, tier-3, and rural regions.

• Expansion of Digital Payments: India processes over 314 lakh crore UPI transactions annually, creating a high-volume target for automated financial fraud.

• Growth of Cloud Services: Massive enterprise and government migration to cloud architectures creates complex, misconfigured attack surfaces.

• Internet-Connected Critical Infrastructure: Power grids, nuclear plants, and transport systems increasingly link to IT networks, exposing Operational Technology (OT) to remote cyber intrusions.

• Digital Public Infrastructure (DPI) Interdependence: The interconnected scale of Aadhaar, DigiLocker, and GSTN means a vulnerability in one auxiliary node risks cascading exposure across the ecosystem.

• Large User Base with Low Cyber Hygiene: Millions of first-time digital users lack basic awareness regarding deepfakes, phishing, and social engineering.

• Cybersecurity Skill Gaps: India possesses approximately 3.5 to 6.5 lakh trained professionals against an industry demand exceeding 1 million cybersecurity experts.

• Dependence on Complex Digital Ecosystems: Heavy domestic reliance on third-party foreign software libraries and legacy IT stacks introduces hidden supply-chain vulnerabilities.

• Increasing AI Adoption without Guardrails: Organizations integrate generative AI tools rapidly without establishing strict data-governance and model-security frameworks. 

 What are the Major Challenges for India? 

Shortage of Cybersecurity Professionals: India faces an acute deficit of over 1 million cybersecurity, cloud security, and forensic AI specialists.

Unequal Cybersecurity Capacity & MSME Vulnerability: Over 90% of small enterprises operate without dedicated cybersecurity budgets or endpoint protection. 

Legacy Digital Systems in Public Utilities: Government departments operate legacy, unpatched software vulnerable to automated AI vulnerability scanning.Heavy Dependence on Foreign Hardware and Foundational AI: Dependence on foreign GPUs, cloud servers, and proprietary AI models creates strategic vulnerabilities. 

Lack of Real-Time Threat Sharing & Attribution Deadlocks: Fragmented threat-sharing between private enterprises and law enforcement slows nationwide incident response. 

Asymmetry Between Machine-Speed Offense and Manual Defense: Threat actors require only a single unpatched flaw to breach networks, while defenders must secure every endpoint continuously.

Way Forward?

Build AI-Enabled Cyber Defence & Zero Trust Architecture: Enforce strict Zero Trust, continuous micro-segmentation, and active biometric liveness verification across power grids, banking networks, and government portals.

Develop Indigenous Cybersecurity Technologies & AI Stack: Invest in domestic AI foundation models, sovereign compute clusters under the IndiaAI Mission, and secure indigenous operating systems (BOSS Linux). 

Institutionalize 12-Hour Rapid Vulnerability Remediation: Enforce automated patching and continuous attack surface monitoring across all critical public and private digital systems. 

Expand Cybersecurity Workforce through PPP Academies: Create specialized Cyber Defence Academies across IITs, IIITs, and NFSU to bridge the 1-million cybersecurity professional deficit by 2030. 

Protect Critical Information Infrastructure via Public-Private Cooperation: Mandate joint threat intelligence sharing between NCIIPC, sectoral CERTs, and private cloud providers. 

Enact the Digital India Act with AI Model Security Standards: Replace the outdated IT Act, 2000 with modern legislation enforcing strict liability for AI model security, data breaches, and algorithmic safety. 

Maintain Human Oversight & Conduct Regular Cyber Drills: Preserve Human-in-the-Loop governance while running simulated cross-sectoral cyber war games to test national incident response.

Conclusion

AI is transforming cybersecurity into a machine-speed battleground; India must combine indigenous AI technological sovereignty, Zero Trust architecture, and rapid workforce development to safeguard its digital public infrastructure and national security. 

Source: INDIANEXPRESS