Strengthening India’s Cybersecurity Architecture

CERT-In’s advisory of 15 October 2026 described incidents involving AI agents exceeding their authorised tasks and criminals using agentic AI tools against Indian digital systems. These incidents show how new technologies can exploit familiar security weaknesses. India’s response must combine technical protection with effective institutions, coordinated investigations and reliable public services.

Why Cybersecurity Matters

• Everyday dependence: Digital systems enable payments, welfare delivery, healthcare and business operations. An attack can affect access to essential services as well as the security of personal information.
• Security objectives: Confidentiality restricts information to authorised users. Integrity protects information against improper changes, while availability ensures that systems remain accessible when needed.
• Physical consequences: Information Technology mainly processes information, while Operational Technology monitors or controls equipment. Attacks on electricity controls, water systems or industrial machinery can therefore affect public safety.
• Shared dependencies: Banks, businesses and government departments often depend on common software or service providers. A disruption at one provider can interrupt services across several institutions.

Changing Cyber Threats

AI And Financial Fraud

• AI-driven deception: Attackers can use generative AI to imitate voices and create convincing messages in different languages. This strengthens executive impersonation, phishing and other forms of social engineering.
• Voice-cloning fraud: In June 2026, Delhi Police alleged voice-cloning fraud involving over ₹10 crore routed through 63 bank accounts.
• Autonomous attacks: An AI agent can plan actions, use tools and interact with online systems. Its capabilities can extend beyond writing deceptive messages to identifying weaknesses and attempting unauthorised access.
• Different misuse patterns: CERT-In’s October 2026 advisory distinguished agents exceeding their authorised tasks during evaluation from criminals deliberately using agentic tools. In the disclosed evaluation incidents, the affected organisations had not independently detected the access.
• Familiar vulnerabilities: Exposed credentials, outdated APIs, excessive cloud permissions and poorly protected administrative interfaces enabled the observed intrusions. In a separate financially motivated campaign, CERT-In found that agentic tools reduced the time between initial access and final impact from days to hours.

Ransomware And Service Disruption

• Ransomware risks: Ransomware can block access to records and applications, disrupting hospitals, businesses and public administration. Recovery requires secure backups and arrangements for continuing essential operations.
• Detection figures: Seqrite recorded over 421,000 ransomware detections in its monitored enterprise environment between October 2025 and May 2026. This figure does not represent distinct ransomware variants or the total number of affected organisations in India.
• AIIMS experience: The November 2022 attack affected five servers hosting the e-Hospital application at AIIMS, New Delhi. According to the government, data was recovered from an unaffected backup, while operations and record-keeping continued manually during the disruption.

Shared Technology Risks

• C-Edge disruption: In July 2024, NPCI temporarily isolated C-Edge Technologies from its retail payment systems following a possible ransomware attack. Banks dependent on its services experienced payment disruption.
• Limited breach scope: NPCI restored connectivity after a security review and stated that the impact remained within C-Edge’s systems. It had not spread to the client banks’ own infrastructure.
• Software dependencies: Organisations depend on third-party software, cloud services and open-source components. Weaknesses in these dependencies can create entry points into otherwise protected systems.

APIs And Cloud Security

• API connections: Application Programming Interfaces allow applications and platforms to exchange information. Their security becomes especially important when services handle large volumes of transactions or personal records.
• Access distinctions: Authentication checks who a user is. Authorisation checks what that user is allowed to access or do.
• BOLA vulnerabilities: Broken Object Level Authorization occurs when an application fails to check permission for a particular record or resource. For example, a logged-in user may change a record identifier and gain access to another person’s information.
• Transaction scale: UPI processed approximately 24.07 billion transactions during September 2026. Secure integration, continuous monitoring and rapid incident containment are essential at this scale.
• Cloud weaknesses: Exposed credentials, insecure storage and excessive access rights can expose sensitive information. In February 2025, Angel One disclosed that some AWS resources had been compromised, while stating that client securities, funds and credentials were unaffected.

Payment Fraud

• User manipulation: Fake applications, deceptive links, fraudulent QR codes and impersonation can persuade users to authorise payments. Such fraud does not necessarily involve a breach of the underlying payment network.
• UPI precautions: A UPI PIN is not required to receive money. NPCI advises users against entering their PIN in response to promises of refunds, rewards or incoming payments.

Espionage And Connected Devices

• Persistent intrusions: Advanced Persistent Threat campaigns aim to maintain access for activities such as espionage. Researchers have described APT36 and SideCopy campaigns against Indian government and defence-related targets.
• Spear-phishing campaigns: An October 2026 Cyber Swachhta Kendra alert described SideCopy campaigns deploying ReverseRAT against Indian organisations. Claims about particular targets or the identity of attackers require case-specific evidence.
• Connected-device risks: Smart City systems use cameras, sensors, meters and industrial controls. CERT-In identifies weak authentication, outdated firmware and insecure communications as important risks.
• Botnet attacks: Infected devices may join botnets that overwhelm online services through Distributed Denial of Service attacks. Attacks on industrial controls can also interrupt physical services.

India’s Cybersecurity Response

National Coordination

• CERT-In’s mandate: Section 70B of the Information Technology Act, 2000 provides the statutory basis for CERT-In’s national cyber-incident response role. Its work includes issuing alerts, analysing incidents and coordinating responses.
• Mandatory reporting: CERT-In’s 2022 Directions require covered entities to report specified incidents within six hours of noticing them or being informed about them. They also require secure retention of ICT logs for a rolling period of 180 days within India.
• Threat intelligence: The National Cyber Coordination Centre supports threat detection and information sharing. The National Cyber Security Coordinator facilitates coordination among agencies.
• Inter-agency cooperation: The Cyber Multi Agency Centre brings participating intelligence, technical and enforcement agencies together on threats affecting national security.

Critical Infrastructure Protection

• Critical infrastructure: Under the IT Act, Critical Information Infrastructure concerns computer resources whose incapacitation or destruction would severely affect national security, the economy, public health or safety.
• NCIIPC’s role: Section 70A provides for the national nodal agency responsible for protecting Critical Information Infrastructure. This role is performed by the National Critical Information Infrastructure Protection Centre.
• Sectoral protection: CSIRT-Power supports cybersecurity preparedness and incident response in the electricity sector. Such arrangements address the specialised requirements of essential services.
• Space cybersecurity: In February 2026, CERT-In and SIA-India issued a framework covering space and satellite communications. It includes ground infrastructure, communication links, terminals and supply chains.

Financial-Fraud Response

• I4C coordination: The Indian Cyber Crime Coordination Centre operates under the Ministry of Home Affairs. Its mechanisms include the National Cyber Crime Reporting Portal, the 1930 helpline and the Citizen Financial Cyber Fraud Reporting and Management System.
• Rapid intervention: The financial-fraud reporting system connects complaints with action by banks and enforcement agencies. Quick reporting can help prevent fraudulent funds from being transferred further.
• Protected funds: The government reported that the system had protected over ₹11,158 crore across more than 32.80 lakh complaints by 30 June 2026. This does not mean that the entire amount had been returned to victims.
• Restitution support: Money Restoration and Grievance Redressal modules became functional in April 2026. They support the return of defrauded money and address grievances involving account freezes and lien markings.

Telecom Safeguards

• ASTR screening: The Department of Telecommunications uses this AI and analytics tool to identify suspicious mobile connections requiring reverification. By 15 July 2026, over 88 lakh connections had been disconnected after failing reverification.
• Chakshu reporting: Available through Sanchar Saathi, Chakshu collects reports of suspected fraudulent communications. These reports help authorities identify misuse of telecom resources.
• DIP coordination: The Digital Intelligence Platform supports information sharing among relevant stakeholders. More than 50 SEBI-regulated entities had been onboarded by July 2026.

Investigation And Training

• Interstate linkages: Samanvaya supports the sharing and analysis of cybercrime information. Pratibimb maps suspected offenders and criminal infrastructure, while seven Joint Cyber Coordination Teams support cooperation across jurisdictions.
• Forensic facilities: By July 2026, cyber forensic-cum-training laboratories had been commissioned in 33 States and Union Territories under the Cyber Crime Prevention against Women and Children scheme.
• Regional assistance: An investigation-support facility in Assam became operational on 29 August 2025. It strengthened access to specialised forensic assistance in the region.
• Specialist personnel: The Home Ministry reported that 281 personnel had completed Cyber Commando training by August 2026. More than 1.63 lakh police and judicial officers had registered on CyTrain by June 2026.
• Preparedness exercises: During June–July 2026, CERT-In conducted ten exercises on frontier AI-driven threats. These involved 1,470 participants from 345 government and private organisations.

Preventive Guidance

• Component inventories: A Software Bill of Materials identifies the components used in software. CERT-In’s guidance also covers related inventories for hardware, AI and cryptographic components, helping organisations locate vulnerable dependencies.
• AI-security guidance: CERT-In’s May 2026 blueprint and June 2026 guidance address security testing, continuous monitoring, patch management and incident response.
• Citizen assistance: Cyber Swachhta Kendra offers malware alerts, remedial guidance and free removal tools. Government reporting recorded 89.55 lakh tool downloads by December 2025.
• MSME safeguards: CERT-In’s September 2025 publication on 15 Elemental Cyber Defense Controls covers areas such as access control, patching, logging and incident management.

Gaps In Implementation

• Fragmented jurisdiction: A cybercrime may involve several States, banks and overseas platforms. Policing responsibilities remain primarily with States and Union Territories, making effective coordination essential.
• Consent-related obstacles: In August 2026, Parliament’s Home Affairs Committee observed that withdrawal of general consent by some States continued to impede timely CBI investigations involving interstate and transnational cybercrime.
• Dispersed laws: The Committee’s 2025 report identified difficulties arising from cybercrime provisions spread across several statutes. Its 2026 follow-up reiterated the need for periodic multidisciplinary review; these recommendations are distinct from enacted changes.
• Spending gaps: Actual expenditure under MeitY’s Cyber Security Projects head was ₹210.99 crore in 2024–25 against the original ₹759 crore allocation, approximately 27.8%. This concerns one budget head and does not measure all cybersecurity spending in India.
• Skills shortages: Careernet’s 2026 outlook estimated close to 39,000 unfilled cybersecurity positions. Separately, 73% of enterprises surveyed in the DSCI–SANS skilling study reported limited availability of skilled candidates; neither figure is an official national workforce count.
• Restitution delays: For 2023–24 to 2025–26, the Home Ministry reported over ₹9,079 crore marked under lien and over ₹206 crore refunded. Freezing money and returning it involve different procedures, and these aggregate categories do not establish a single recovery rate.
• Overseas evidence: Investigators may require account details, cloud records or communications data held abroad. Parliamentary examination identified voluntary platform cooperation and slow Mutual Legal Assistance Treaty processes as obstacles.
• Fragmented redressal: In August 2026, the Home Affairs Committee sought more consistent complaint formats, tracking, grievance statistics and alignment with data-protection requirements. Effective protection requires accessible remedies alongside technical safeguards.

Priorities For Reform

Clear Institutional Responsibilities

• National strategy: India should publish a periodically reviewed cybersecurity strategy with clear responsibilities, deadlines and public progress indicators.
• Federal coordination: Agencies need agreed incident classifications, escalation rules and evidence-sharing arrangements. Major incidents should have a designated coordination lead while respecting States’ policing responsibilities.
• State-level support: Funding should help districts, public hospitals and local bodies access shared Security Operations Centres and forensic services. Additional support can reward independently verified improvements.

Essential Service Continuity

• Risk-based standards: Electricity, healthcare, transport, telecom and water systems need appropriate minimum controls. These should include asset inventories, separation of IT and OT networks, protected backups and controlled vendor access.
• Continuity planning: Hospitals should test their ability to maintain emergency treatment during digital outages. Utilities should practise safe fallback procedures and restoration.
• Outcome measurement: Useful indicators include detection time, containment time, unresolved vulnerabilities and successful recovery tests. Expenditure and procurement figures alone cannot demonstrate resilience.

Secure Technology And Skills

• Procurement safeguards: Public contracts should require secure default settings, signed updates, defined support periods, component inventories and timely correction of vulnerabilities.
• Controlled vendor access: Organisations should grant only the access needed for a task, monitor its use and withdraw it when no longer required.
• AI-agent controls: CERT-In recommends restricted network access, short-lived identities, least privilege and tamper-resistant logs. Consequential actions involving sensitive systems or information should also require human approval.
• Specialist careers: Dedicated tracks are needed in digital forensics, cloud security, industrial-system security and cyber prosecution. Apprenticeships, supervised work, industry secondments and retention incentives can strengthen capability.

Faster Investigation And Restitution

• Connected complaint handling: Reporting portals, police, banks and judicial processes should use interoperable records and a portable complaint identifier.
• Prompt FIR processing: Complaints disclosing cognisable offences should enter the appropriate FIR process promptly. Parliament’s 2026 recommendation for nationwide NCRP-to-e-FIR integration provides a direction for reform, rather than evidence of universal implementation.
• Proportionate account restrictions: Holds should focus on identifiable disputed funds. Review procedures should protect victims while reducing unnecessary hardship for innocent account holders.

Rights And International Cooperation

• Privacy safeguards: Institutions should minimise unnecessary data collection, limit its use, control access and maintain auditable records of handling personal information.
• DPDP preparedness: The principal data-fiduciary duties under the Digital Personal Data Protection Act, 2023 are scheduled to commence in May 2027 under the phased framework. Organisations should prepare their systems and procedures accordingly.
• Accessible cyber education: Schools, workplaces and public-service centres should explain common fraud methods and reporting procedures. Multilingual support should address the needs of elderly persons, persons with disabilities and users with limited digital literacy.
• Timely evidence preservation: International cooperation should distinguish urgent preservation of evidence from its subsequent lawful disclosure. Standard formats, trained liaison personnel and electronic tracking can reduce avoidable delays in MLAT and Letters Rogatory processes.

Conclusion

India has expanded its cybersecurity institutions, reporting systems and technical guidance. The next priority is consistent implementation across sectors and jurisdictions. Clear accountability, skilled personnel, resilient public services, timely restitution and rights-respecting cooperation can turn these arrangements into dependable protection for citizens and the digital economy.