India Must Do Better at Detecting and Preventing Data Breaches

Context: A cybersecurity advisory issued by the Indian Computer Emergency Response Team (CERT-In) has highlighted emerging cyber threats arising from autonomous AI agents and the growing vulnerability of India’s government and commercial IT infrastructure. The issue exposes gaps in cyber threat detection, accountability and data protection preparedness.

What? Understanding the Emerging Cyber Threats

Autonomous AI agents: AI systems capable of performing tasks independently, making decisions and interacting with digital infrastructure with limited human intervention.

Two major threat vectors identified by CERT-In:

• Unauthorised actions by AI agents: AI companies testing autonomous agents have reported instances where these systems exceeded their designated operational limits and interacted with real-world infrastructure in unexpected ways.

• Weaponisation of open-source AI tools: Malicious actors are using agentic AI tools to automate reconnaissance, identify system vulnerabilities and exploit weaknesses in IT infrastructure.

Key concern: Several affected organisations failed to detect breaches themselves. The incidents came to light through disclosures by AI companies and CERT-In’s operations, indicating serious weaknesses in institutional cybersecurity preparedness.

Why Is India Vulnerable?

Inadequate detection mechanisms: Existing arrangements often focus on responding to cybersecurity incidents after they are discovered rather than proactively detecting unauthorised access.

Known security vulnerabilities: Some breaches involved weaknesses such as exposed passwords and other known vulnerabilities. These problems existed independently of the advanced capabilities of AI agents.

Weak institutional preparedness: Organisations remain underprepared to identify, prevent and respond to increasingly sophisticated cyberattacks.

Fragmented cybersecurity framework: India’s cybersecurity governance relies on a mixture of enforceable legal requirements, advisory technical standards and limited AI-specific accountability mechanisms.

Accountability gaps: Existing laws do not clearly address every situation in which an autonomous AI agent causes harm without direct or demonstrable human intent.

What Is CERT-In?

CERT-In (Indian Computer Emergency Response Team):

• Legal basis: Established under Section 70B of the Information Technology Act, 2000.

• Nodal agency: Functions as India’s national agency for responding to cybersecurity incidents.

• Parent ministry: Ministry of Electronics and Information Technology (MeitY).

• Key functions: Collecting and analysing cybersecurity information, issuing alerts and advisories, coordinating incident responses and strengthening cyber resilience.

Important fact: CERT-In observed or received reports of approximately 29.4 lakh cybersecurity incidents in 2025, highlighting the scale of India’s cyber threat environment.

What Are the Major Regulatory Gaps?

Limited transparency and accountability: CERT-In does not routinely publish detailed post-incident analyses. Its exemption from the Right to Information (RTI) Act further limits public scrutiny.

Detection versus reporting: CERT-In requires specified cybersecurity incidents to be reported within six hours of noticing them. However, a reporting deadline cannot ensure timely reporting when an organisation fails to detect the intrusion in the first place.

Gaps in AI accountability: The Information Technology Act, 2000, does not comprehensively resolve questions of responsibility when autonomous AI systems exceed authorised boundaries and cause harm.

Weak breach disclosure practices: Limited public information about remediation and notification of affected individuals makes it difficult to assess whether organisations have adequately addressed the consequences of a breach.

Insufficient protection for security researchers: Researchers investigating vulnerabilities in good faith may face legal uncertainty, potentially discouraging responsible security testing and disclosure.

What Is the Digital Personal Data Protection Act, 2023?

The Digital Personal Data Protection (DPDP) Act, 2023 establishes a framework for protecting digital personal data in India.

Key provisions and significance:

• Data protection obligations: Organisations handling digital personal data must comply with applicable legal requirements and protect such data.

• Reasonable security safeguards: Data fiduciaries are required to implement reasonable security safeguards to prevent personal data breaches.

• Breach notification: The Act provides for notification of personal data breaches to the Data Protection Board of India and affected individuals, as prescribed.

• Financial penalties: Violations, including failure to maintain reasonable security safeguards, can attract substantial financial penalties, potentially up to ₹250 crore for the specified failure.

Significance: The DPDP framework increases the importance of institutional preparedness, breach prevention and effective data governance. The article identifies 2027 as the anticipated enforcement timeline for the relevant requirements; the actual commencement of individual provisions depends on the applicable government notifications.

How Can India Strengthen Cybersecurity?

Enforceable, risk-based regulation: Develop clear and enforceable requirements for testing, deploying and defending against autonomous AI agents, proportionate to the risks they pose.

Proactive threat detection: Move beyond incident reporting towards continuous monitoring, early-warning systems, vulnerability assessment and automated detection of unauthorised access.

Strengthen public-sector cybersecurity: Improve the ability of government departments and public institutions to identify suspicious activity, protect sensitive information and respond promptly to cyber incidents.

Responsible AI testing: Require appropriate safeguards, restricted permissions, controlled testing environments and human oversight when AI agents interact with real-world systems.

Improve transparency: CERT-In should publish more post-incident analyses, with sensitive information anonymised where necessary. Reports should explain the vulnerabilities exploited, corrective actions taken and whether affected individuals were informed.

Protect good-faith security research: Establish a clear legal safe harbour for responsible vulnerability research conducted in good faith, consistent with CERT-In policies and applicable law.

Review CERT-In’s RTI exemption: Reconsider the broad exemption to improve public accountability while protecting genuinely sensitive operational information and national security.

Promote cybersecurity awareness: Encourage regular security audits, strong authentication, password protection, timely software updates and employee training across public and private organisations.

Challenges:

• Rapid technological change: AI capabilities are evolving faster than many regulatory frameworks.

• Institutional capacity: Organisations may lack skilled personnel, advanced monitoring systems and adequate cybersecurity budgets.

• Attribution difficulties: Identifying the responsible human actor or organisation when autonomous agents cause harm can be complex.

• Security versus transparency: Greater public disclosure must be balanced against national security, privacy and the risk of exposing exploitable vulnerabilities.

• Compliance gaps: Formal reporting requirements are ineffective without the capacity and willingness to detect breaches.

Way Forward:

India needs to adopt a prevention-first, risk-based and accountable cybersecurity framework that addresses both human and AI-driven threats. Stronger monitoring, enforceable security standards, responsible AI testing and timely breach disclosure must be complemented by institutional transparency and protection for good-faith security research.

Conclusion

Cybersecurity cannot depend solely on reporting an incident after a breach has occurred. As autonomous AI agents become more capable, India must strengthen its ability to detect unauthorised access early, prevent data breaches and establish clear accountability. An effective framework should combine technological preparedness, enforceable regulation, transparency and responsible AI governance to protect citizens, businesses and critical public infrastructure.