AI Cybersecurity India: Threats, Defence, and Preparedness

UPSC Mapping

Prelims	Science & Technology
Mains	GS Paper 3 (Science & Technology & Internal Security)

Article

AI Cybersecurity India is a critical and emerging challenge, as artificial intelligence is transforming both cyberattacks and defences at unprecedented speed. AI can now act as an autonomous agent that can identify, plan, adapt, and carry out offensive cyber operations, making the cyber kill chain faster and more sophisticated. For more such science and technology updates, explore the science and technology archive.

What is AI Cybersecurity India?

AI Cybersecurity India refers to the use of artificial intelligence to both launch and defend against cyberattacks. AI is rapidly being adopted across the cyber kill chain—from automated vulnerability discovery to AI-generated deepfakes and AI-enabled social engineering. The most significant development is AI’s ability to act as an autonomous agent, capable of identifying, planning, adapting, and executing offensive cyber operations with limited human intervention.

This creates a cybersecurity paradox: automated attacks are met with automated defence. Countries with leading AI ecosystems gain a greater ability to conduct sophisticated cyber campaigns and defend against them. However, AI capabilities remain concentrated in very few countries, raising pressing questions for India’s preparedness.

Why is AI Cybersecurity India in News?

AI Cybersecurity India is in the news following the emergence of AI-orchestrated cyber-espionage campaigns. In September 2025, Anthropic claimed that a Chinese state-sponsored group, GTG-1002, had used Claude Code as an autonomous cyber agent across multiple stages of an attack—the first reported case of an AI-orchestrated cyber-espionage campaign. Additionally, Anthropic’s latest frontier model, Claude Mythos Preview, has identified thousands of zero-day vulnerabilities across major operating systems and browsers, including a 27-year-old vulnerability in OpenBSD, an operating system reputed to be highly security-hardened.

These vulnerabilities are especially dangerous for Operational Technology and Industrial Control Systems that govern nuclear facilities, energy grids, and communications networks. For more details, refer to this PIB release.

Key Features of AI Cybersecurity India

• AI-Powered Threats: LLM-generated polymorphic malware can autonomously generate, modify, and restructure code, evading traditional signature-based detection.
• Zero-Day Vulnerabilities: AI models can identify previously unknown software flaws at scale, creating critical risks.
• Critical Infrastructure Risk: Operational Technology (OT) and Industrial Control Systems (ICS) are increasingly exposed to AI-driven attacks.
• AI for Defence: AI enables real-time threat detection, automated response, and large-scale data analysis.
• The AI Divide: The real divide is not about who uses AI but who builds and controls its development.

Challenges in AI Cybersecurity India

• AI Ecosystem Gap: India’s indigenous AI ecosystem lags behind the US and China across foundational models, GPUs, chip design, and data-centre infrastructure.
• Attack Frequency: India is the second-most cyber-attacked nation after the US (CloudSEK 2024).
• Critical Sector Targeting: Pakistan-based threat actors like APT36 have targeted India’s critical sectors, including the Ministry of Defence, Army, Navy, and DRDO.
• Dependence: India remains heavily dependent on the US and other technologically advanced countries for AI capabilities.
• Old Defences: Traditional antivirus and static security patches are far less effective against AI-driven threats. For more on internal security, visit the security section.

Way Forward for AI Cybersecurity India

To strengthen AI Cybersecurity India, the government should integrate AI and cybersecurity policymaking as interconnected strands. Agencies like CERT-In have already adopted AI-driven threat detection and issued advisories treating every newly discovered vulnerability as something that ‘could be exploited within hours, not weeks.’ The Ministry of Electronics and Information Technology is exploring a consent-based framework for synthetically generated content, curbs on agentic AI autonomy, and clearer liability frameworks for AI models.

Building the AI stack overnight is impossible, but India must invest in foundational AI research, GPU infrastructure, and cybersecurity talent. International cooperation, responsible AI governance, and human oversight of high-risk autonomous systems are essential. For international best practices, refer to the CISA.

Prelims Practice Corner

1. Q1. What is the cyber kill chain?

   • (a) A sequence of cyberattack stages
   • (b) A defence mechanism
   • (c) A firewall
   • (d) An encryption standard

   Answer: (a) The cyber kill chain is a sequence of stages in a cyberattack.

2. Q2. What is a zero-day vulnerability?

   • (a) A known vulnerability
   • (b) A flaw unknown to the vendor
   • (c) A patched vulnerability
   • (d) A hardware bug

   Answer: (b) A zero-day vulnerability is unknown to the vendor.

3. Q3. Which agency handles cyber incident response in India?

   • (a) NCIIPC
   • (b) CERT-In
   • (c) MeitY
   • (d) ISRO

   Answer: (b) CERT-In is the national agency for cyber incident response.

4. Q4. What is LLM-generated polymorphic malware?

   • (a) Malware with a fixed signature
   • (b) Malware that autonomously generates and modifies code
   • (c) A type of virus
   • (d) Ransomware

   Answer: (b) Polymorphic malware can autonomously modify its code to evade detection.

5. Q5. What is the significance of the Claude Mythos Preview model?

   • (a) It is a chatbot
   • (b) It identified thousands of zero-day vulnerabilities
   • (c) It is a defence tool
   • (d) It is a social media app

   Answer: (b) It identified thousands of zero-day vulnerabilities across major systems.

Mains Practice Questions

1. Q1. Discuss the dual-edged nature of AI in cybersecurity and evaluate India’s preparedness to address AI-enabled cyber threats. (250 words, 15 marks)

   Answer Structure:

   • Intro: Introduce AI’s transformative role in cyberattacks and defence.
   • Body: Discuss AI as an autonomous agent, zero-day vulnerabilities, and threats to critical infrastructure. Analyse India’s challenges: AI ecosystem gap, attack frequency, and dependence on foreign tech. Suggest measures: AI for defence, CERT-In initiatives, responsible governance.
   • Conclusion: Emphasise the need to treat AI and cybersecurity as interconnected policymaking strands.

2. Q2. What is the cyber kill chain, and how is AI transforming each stage of it? (150 words, 10 marks)

   Answer Structure:

   • Intro: Define the cyber kill chain as a sequence of cyberattack stages.
   • Body: Explain how AI automates reconnaissance, weaponisation, and command-and-control. Mention polymorphic malware and zero-day vulnerabilities.
   • Conclusion: Conclude that AI makes the entire attack chain faster and more autonomous.

FAQs on AI Cybersecurity India

What is AI cybersecurity?

It is the use of artificial intelligence to both launch and defend against cyberattacks.

How is India vulnerable to AI cyber threats?

India’s AI ecosystem lags behind, it is the second-most cyber-attacked nation, and critical sectors are being targeted.

What is CERT-In doing to address AI cyber risks?

CERT-In has adopted AI-driven threat detection and issued advisories for organisations to defend against AI-driven cyber risks.