CERT-In’s AI-Era Cyber Rules Test Enterprise Reality

Hackers move quickly, especially with artificial intelligence there to help them. Cyber defenders should move just as fast, said India’s cybersecurity agency in guidance advising that organizations mitigate serious new flaws within 12 hours.

See Also: Know Thy Enemy: Threats to Cyber Resilience

The recommendation comes from the Indian Computer Emergency Response Team guidance warning that AI is compressing the time between vulnerability discovery and exploitation.

The 12-hour proposal applies to known exploited vulnerabilities on internet-facing or critical business systems. Organizations could satisfy CERT-In through temporary containment, including isolating a system, restricting access, deploying a web application firewall or disabling the vulnerable feature until a full patch is ready.

Cyber defenders lowered mitigation turnaround to 24 hours for known exploited vulnerabilities affecting internal systems and a comparatively leisurely three days for critical vulnerabilities on internal systems affecting high-value functionality.

Security researchers welcomed broadly the guidance’s ambitions while questioning whether most Indian organizations can realistically deliver.

Anant Shrivastava, chief researcher and founder of Cyfinoid Research, said the blueprint is “directionally a strong and necessary document” but should be read as a strategic aspiration rather than an operational baseline.

The challenge is in what the document implicitly assumes. “The blueprint largely assumes organizations already possess a certain level of operational maturity, visibility, engineering discipline and remediation capacity.” Many organizations, particularly outside large enterprises, struggle with accurate asset inventories, clear system ownership, tested rollback procedures and the engineering capacity to push changes safely under compressed timelines.

The 12-hour target is not realistic for most organizations – and would likely backfire if it became a mandate, Shrivastava said. “Aggressive remediation timelines can unintentionally turn into compliance theatre where organizations either hide exposure, delay reporting or apply rushed changes without proper validation.”

The blueprint recommends a phased approach, with foundational steps such as enabling multifactor authentication and patching known exploited vulnerabilities expected within the first seven days, followed by continuous monitoring and AI governance capabilities within 30 days, and adversarial simulation and AI security testing in a final phase spanning days 31 to 60.

CERT-In’s point about a diminishing window to fix known vulnerabilities before they’re exploited by hackers is matched by independent data. Check Point found earlier this year that organizations globally faced nearly 2,000 cyberattacks per week on average in 2025 as attackers increasingly used AI to automate operations at scale. “AI is changing the mechanics of cyberattacks, not just their volume,” said Lotem Finkelstein, vice president of research at Check Point Software.

AI is already helping threat actors improve reconnaissance, phishing quality, exploit research, malware adaptation and social engineering at lower cost and higher speed.

It’s not just attackers that use AI. Defenders deploy it, too, for tasks such as alert triage, correlation, detection engineering assistance and threat intelligence enrichment. But defenders may often find that that tool makers oversell AI capabilities or deploy it without fixing basic visibility and identity problem.

“AI compresses time, but it does not magically create operational maturity. That is the key challenge organizations now need to solve,” Shrivastava said.