AI-Driven Cyber Threats and India's Evolving Digital Legal Framework

The CERT-In advisory on AI-driven cyber threats and the limitations of India's current legal framework highlights the escalating vulnerabilities in the nation's digital infrastructure. The emergence of autonomous agents and the weaponization of open-source AI tools for automated reconnaissance represent a paradigm shift in cyber warfare and security. Unlike conventional cyber attacks that relied largely on human intervention, AI-driven threats can execute complex breaches at machine speed, bypassing traditional defenses. The editorial underscores a critical implementation gap: while organisations are mandated to report intrusions within six hours, many lack the fundamental detection capabilities to even identify these breaches. Furthermore, the reliance on basic, unpatched vulnerabilities—such as exposed passwords—reveals that the systemic hygiene of India's IT infrastructure remains weak even before confronting advanced AI capabilities. The regulatory landscape is equally fragmented, characterized by sector-specific rules, advisory standards, and a narrow definition of AI accountability. The impending DPDP Act 2027 introduces strict penalties for data non-compliance, but the absence of a comprehensive cyber security framework leaves critical sectors exposed. Additionally, the exemption of CERT-In from the RTI Act and the lack of a legal safe harbor for good-faith security researchers stifle transparency and collaborative defense. To build true cyber resilience, India must move beyond compliance checklists. It requires risk-based enforceable standards, enhanced detection infrastructure, institutional transparency, and legal protections for ethical hackers who form the first line of defense against sophisticated digital adversaries.