Indian Computer Emergency Response Team (CERT-In) Releases Blueprint to Counter AI-Assisted Cyberattacks

Key facts

• The Indian Computer Emergency Response Team (CERT-In) released the "Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure" on May 25, 2026.
• CERT-In has mandated that companies fix, block, or reduce risks from known security flaws affecting internet-facing systems and 'crown-jewel' assets within 12 hours wherever possible.
• The blueprint specifies that critical vulnerabilities exposed to the internet must be fixed within one day, internal system flaws being exploited within 24 hours, and high-severity vulnerabilities within five days.
• The first two phases of the agency's three-step plan focus on vulnerability assessments, multi-factor authentication (MFA), security logging, patching critical flaws, monitoring, threat detection, cloud security, and AI governance.
• The final phase of the suggested plan includes red-team exercises, cyber resilience testing, and security automation.