A security operations center in Bengaluru gets an alert at 2 a.m. An analyst opens the ticket and finds a phishing email so carefully written, so fluent in the rhythms of the company’s internal correspondence, that it takes twenty minutes to confirm it wasn’t a colleague. The malware behind it had already probed three internal systems. Nobody clicked yet. But the defenders are running on coffee and instinct, and the attackers are running on models.
This is the new shape of the problem, and it isn’t unique to India. Reports from NBC News and ABC News describe AI helping both sides find vulnerabilities at extraordinary speed, with AI models even using fake identities to trick humans in simulated attacks. What makes the Indian case worth a closer look is the scale of the target combined with the unevenness of the defenses.
India’s digital public infrastructure is sprawling and ambitious. Unified payments, identity systems, and government portals process volumes that most countries would envy. That also means an attack surface that grows faster than most security teams can map, let alone harden. Banks, hospitals, small manufacturers, and state agencies often run legacy software with thin patching budgets. When offensive AI can scan for weaknesses around the clock and draft convincing lures in local languages and dialects, the asymmetry gets sharper.
The Deccan Herald framing, asking whether India is ready, deserves a nuanced answer. In pockets, yes. The country has a deep pool of security talent, a mature IT services industry, and government bodies that have pushed CERT-In advisories and incident reporting rules in recent years. But readiness across the broader economy is another matter. A mid-sized logistics firm in Pune doesn’t have a red team. It has one IT generalist and an outsourced helpdesk. Against automated, AI-assisted reconnaissance, that gap is not theoretical.
There’s a second-order problem too. The same tools that help defenders hunt for weaknesses also let attackers find them first. Vulnerability discovery used to be a bottleneck for criminals; now it’s increasingly a commodity. When finding flaws gets cheaper, the economics of exploitation shift toward volume. That means more noise, more attempts, and more chances that one of them lands. Security teams already drowning in alerts face a future where the alert queue is partly generated by machines designed to be persuasive.
Some of the response has to be structural. Basic hygiene still matters enormously: patching, multi-factor authentication, network segmentation, and tested backups. AI doesn’t make those obsolete; it makes neglecting them more expensive. Beyond that, organizations need to accept that detection models trained on yesterday’s attack patterns will lag. Adversaries are iterating faster than signature libraries update.
India has assets it can lean on. A large developer population means security automation is buildable in-house. The open-source ecosystem offers agentic security operations platforms, like the MIT-linked Argus project, that small teams can adopt without enterprise licensing fees. Public-private threat intelligence sharing, if done with real urgency rather than annual conferences, could shorten the window between an attack seen in one sector and a defense deployed in another.
Talent is the harder knot. Security analysts burn out fast. If AI can triage the routine noise, it frees humans for the judgment calls that machines still fumble. That’s the optimistic path: defenders using AI to buy back attention. The pessimistic path is that underfunded organizations use AI as a cost-cutting excuse and lose the human oversight that catches the strange, off-pattern intrusion.
There’s also a policy dimension, though it’s less about new laws than about enforcement and incentives. Mandatory breach reporting exists on paper. In practice, reputational fear pushes incidents underground. Without honest data on what’s actually happening, neither the government nor industry can calibrate defenses. AI-driven attacks will make underreporting more tempting and more dangerous at the same time.
None of this argues for fatalism. India’s cyber defenders have handled serious incidents before, and the country’s IT workforce is not short on skill. But the comfortable assumption that AI is a problem for later, for bigger firms, or for someone else’s budget is no longer affordable. The attackers have already automated. The question is whether the defenders, and the institutions behind them, move at the same speed.
The 2 a.m. analyst in Bengaluru will get another alert tomorrow. Whether she has better tools, clearer signals, and a team that isn’t stretched to breaking will decide how that story ends.