New Delhi: India’s premier cybersecurity monitoring body has begun detecting vulnerabilities in leading public sector companies using an indigenous testing platform and open-source artificial intelligence models, while also building defences as access to the latest global AI tools remains restricted.
The trial platform has been developed at India’s Computer Emergency Response Team (Cert-In) over the past six months, at a time when the country has rolled out a series of sector-specific regulations to tackle the cyber risks and harms of AI—including the ministry of electronics and information technology's (Meity) curbs on AI deepfakes in February, and the Reserve Bank of India’s (RBI) model risk management framework for banks.
“What we’re doing to prepare ourselves against AI risks is Cert-In’s own sandbox for such vulnerabilities, in which the body is testing cyber vulnerabilities in popular platforms. These open-source and other models can produce about 60% of the overall performance that (Anthropic's) Mythos is capable of, and we’re using this to identify cyber vulnerabilities in various systems and patch them. The idea is that whenever Mythos does become widely available, we should already have a more secure enterprise environment,” said S. Krishnan, secretary at Meity, at a press conference on Monday.
The ‘sandbox’ in question is a closed, trial platform operated by Cert-In, which the body uses to examine cyber vulnerabilities in top companies and alert them.
Such an indigenous platform is needed because the Centre is yet to get an official licence to use and deploy Anthropic’s Claude Mythos family of AI models in India. Launched on 7 April, Mythos was marketed by Anthropic as an algorithm that can find unknown cyber vulnerabilities in IT systems of companies at scale, unlike requiring a human engineer to find them.
On 12 June, the US government barred Mythos from all public access citing national security. The export restrictions were subsequently lifted starting 1 July, but the US curbs reinforced the need for sovereign, indigenous AI models in India—which its two-year-old, ₹10,372-crore AI Mission hasn't been able to create as yet.
The rise in AI tools has been accompanied by an acceleration in cyber attacks. Last fiscal, the average time taken for a cyber attack to exploit an unknown vulnerability came down from 745 days in FY22 to just 44 days, per a report published 29 May by Data Security Council of India (DSCI) and consultancy firm BCG India.
In an interview on the sidelines of Monday's launch of the second Digital Threat Report for the banking sector in FY26, Sanjay Bahl, director general of Cert-In, told Mint that the body has been working with top public sector companies in financial services to identify vulnerabilities using AI, which may have otherwise put public utilities at stake.
“We don’t see the need to maintain a separate database for AI vulnerabilities in India, but we are actively monitoring the impact that AI can have on critical sectors. The cybersecurity blueprint that we are creating as a result is directly relevant to this, and we’re doing this to ensure that once we have access to the top models, we will be able to keep India’s public infrastructure safe,” Bahl said.
Attacks, however, have continued to rise in India. The DSCI-BCG report said cyberattacks doubled to 2.9 million attacks in FY26—up from 1.4 million in FY22.
Both Bahl and Krishnan, however, said that the rise in cyber incidents in India is not because of a lack of penal powers with Cert-In, or any confusions in the hierarchy of India’s cybersecurity reporting and investigations agencies.
“There is no confusion in the cybersecurity reporting structure in India. The National Security Council Secretariat (NSCS) is the overarching body, and Cert-In remains the top cyber reporting and investigations organization across all sectors. Even sectoral regulators, including the RBI and Sebi (Securities and Exchange Bureau of India), report to us—so there is no gap in coordination among the government agencies,” Bahl said.
He emphasised that Cert-In has adequate powers to penalize enterprises for cybersecurity lapses, or compliance failures.
“Through the Cert-In Rules of 2022, we have enough teeth in the organization, and we often penalize companies that fail to comply with our notices and guidelines. But, compliance rates are mostly high, and most of our advisories are followed by companies very well,” he added, without divulging any compliance rate—or how much of Cert-In’s monitoring is automated versus human-inspected.
Krishnan said that the Centre is prioritizing “structured incident response” and “effective information sharing” in face of rising cyber threats. “We’re clear on the structure, but effective information sharing is vital—and we are working on it to see how we can bridge the gaps. We’re also currently discussing how India’s cybersecurity policy is to be updated, though the specifics are yet to be decided,” he said.