The new rules of cybersecurity

Beyond compliance, regulations must prioritise speed and preparedness in responding to threats in the AI age

In July, AI agents undergoing cybersecurity evaluations at OpenAI circumvented restrictions on internet access and compromised systems belonging to Hugging Face, an external artificial intelligence (AI) platform. The incident highlighted an emerging cybersecurity challenge: Increasingly capable AI systems can identify and exploit vulnerabilities without direct human instructions.

 

As AI becomes integrated into critical digital infrastructure, these developments raise questions about the adequacy of existing cybersecurity frameworks. With AI enabling faster identification and exploitation of vulnerabilities, cybersecurity regulations must place greater emphasis on operational resilience.

 

AI is changing the cybersecurity ecosystem in two distinct ways. First, it can strengthen cybersecurity through vulnerability detection, network monitoring, and automated incident response, while enabling malicious actors to identify and exploit weaknesses more efficiently. Second, AI systems themselves introduce vulnerabilities. Techniques such as prompt injection can manipulate models through untrusted inputs, while autonomous agents can access external tools, databases, and operational systems. Weaknesses in the controls governing such access could have consequences beyond the AI application itself.

 

Recent advisories from India’s Computer Emergency Response Team (Cert-In) demonstrate the relevance of these concerns. In October, Cert-In reported incidents of AI agents undergoing evaluation accessing systems belonging to Indian organisations without authorisation. The affected organisations had not detected the intrusions themselves; the incidents were disclosed by AI model providers. Cert-In separately reported financially motivated campaigns involving agentic AI tools, where automation cut the time between initial compromise and impact from days to hours.

 

Another incident involving India’s digital certification provider eMudhra illustrates these challenges. On October 17, an independent researcher identified weak cryptographic keys associated with eight intermediate certificates, potentially using AI-assisted techniques, according to eMudhra. The vulnerabilities could have allowed attackers to issue fraudulent certificates and impersonate legitimate websites, prompting major browser providers to block the affected certificates. Significantly, the weaknesses had remained undetected despite independent audits.

 

These incidents highlight an important distinction. Many vulnerabilities remain conventional, including exposed credentials and inadequate access controls. However, AI can speed up their identification and exploitation, leaving organisations less time to respond. Cybersecurity approaches relying primarily on periodic audits, vulnerability assessments and scheduled remediation may, therefore, become insufficient.

 

India has an established cybersecurity architecture comprising legal, institutional and sector-specific mechanisms. The Information Technology Act, 2000, provides the legislative foundation, with Cert-In serving as the national agency for cybersecurity incident response and National Critical Information Infrastructure Protection Centre responsible for protecting critical information infrastructure.

 

 Cert-In’s directions also mandate reporting specified cybersecurity incidents within six hours, while the National Cyber Coordination Centre facilitates threat-intelligence sharing. These mechanisms are complemented by cybersecurity requirements introduced by sectoral regulators. The challenge is to ensure that this architecture remains effective against AI-related threats, particularly as attacks become faster and more sophisticated. Cert-In’s May 2026 blueprint recommends continuous vulnerability management, AI-aware monitoring and stronger incident-response capabilities. However, operational preparedness remains uneven. A 2025 study by the Data Security Council of India and Palo Alto Networks found that nearly 79 per cent of surveyed respondents planned to integrate AI into cybersecurity operations, while only around 8 per cent reported full integration.

 

India’s financial regulators offer examples of how cybersecurity principles can be translated into institutional responsibilities and measurable requirements. The Reserve Bank of India’s (RBI) directions on IT governance establish board-level responsibility for technology risks, information security, and business continuity. Its cybersecurity directions for non-bank payment system operators also address application security, third-party dependencies and incident response. The RBI’s FREE-AI Committee report adds recommendations for responsible AI adoption in finance.

 

The Securities and Exchange Board of India (Sebi) has adopted a more measurable approach. Its 2024 Cybersecurity and Cyber Resilience Framework introduced a Cyber Capability Index based on 23 weighted parameters, alongside periodic assessments for larger regulated entities. It provides for shared security operations centres to support smaller institutions. More recently, Sebi established a task force in response to advanced AI vulnerability-detection tools, to coordinate threat intelligence, vulnerability management and assessment of third-party risks. As AI changes the nature of cyber risks, the challenge is to adapt these arrangements rather than build a parallel regulatory system. Four priorities follow.

 

First, sectoral regulators should require cybersecurity assessments of AI systems deployed in critical sectors, both before deployment and following significant updates. These assessments should cover models, connected applications, credentials and agent permissions, including testing for unauthorised access and actions. Cert-In could develop common testing protocols, with independent evaluations for high-risk deployments.

 

Second, regulators should add measurable cyber resilience indicators to existing compliance requirements. Drawing on Sebi’s Cyber Capability Index, assessments could track the time taken to detect intrusions, contain compromised systems, revoke unauthorised access and restore critical services. These should be supported by regular simulation exercises and continuous vulnerability monitoring.

 

Third, Cert-In should establish a formal coordination mechanism with critical infrastructure authorities and sectoral regulators. This mechanism could develop common standards for classifying and reporting AI-related cybersecurity incidents, facilitate timely threat-intelligence sharing and coordinate responses to vulnerabilities affecting multiple organisations. Sectoral guidelines should also clarify the responsibilities of AI developers, deployers and third-party service providers, particularly where incidents arise from autonomous AI systems or shared technological infrastructure.

 

Fourth, India should prioritise operationalising the IndiaAI Safety Institute to strengthen cybersecurity testing and evaluation. The Institute could develop common standards for assessing vulnerabilities in AI models and autonomous agents, and establish shared testing facilities. These assessments could inform Cert-In and sectoral regulators in developing measurable requirements for AI-related cyber resilience.

 

India’s forthcoming consultation on AI regulation provides an opportunity to assess these issues.  The broader lesson is relevant beyond India. Existing cybersecurity regulations remain necessary, but their effectiveness will increasingly depend on how well they account for the changing speed and scale  of cyber threats. As AI becomes embedded in critical systems, cybersecurity governance must move beyond procedural compliance towards ensuring that institutions can anticipate, withstand, contain, and recover from emerging risks.

 

        

The writers are, respectively, former chairman of Sebi and associate fellow at Observer Research Foundation