CERT-In mandates 12-hour fix for critical cyber flaws as AI threats surge

CERT-In’s updated cybersecurity framework highlights faster response timelines, risk-based vulnerability management and stronger defenses as organisations face rising use of AI tools for automated hacking, phishing, malware creation and large-scale cyber exploitation.

The Indian Computer Emergency Response Team (CERT-In) has released updated cybersecurity guidelines mandating faster remediation of critical vulnerabilities, especially in internet-exposed systems, as artificial intelligence increasingly accelerates cyberattacks and reduces response time for defenders.

In its latest 38-page framework, the agency has recommended that organisations patch high-risk security flaws within 12 hours, wherever feasible. The directive comes amid growing concerns that threat actors are using AI tools and large language models to automate vulnerability discovery, exploit development, and large-scale attack execution.

CERT-In noted that AI-assisted cyber operations significantly shorten the time required for attackers to identify weak systems, compromised identities, insecure APIs, and misconfigured infrastructure. This has led to faster and more complex attack cycles across digital environments.

AI expands cyber risk landscape

The agency warned that as organisations increasingly rely on cloud platforms, interconnected systems, AI-enabled applications, and complex software supply chains, the potential impact of cyber threats continues to expand across industries.

Cybercriminals are now using AI for multiple stages of attacks, including reconnaissance, phishing content generation, exploit creation, and malware development. This has effectively reduced traditional detection and prevention windows, making systems more vulnerable.

CERT-In also highlighted emerging risks targeting AI systems themselves, including prompt injection attacks, data leakage, model manipulation, training data poisoning, model theft, and orchestration pipeline breaches. These threats can undermine both the integrity and confidentiality of AI-driven systems.

The agency stressed that organisations should prepare for scenarios where exploitation timelines collapse and attacks become increasingly autonomous in nature.

Risk-based security and faster response

To counter these evolving threats, CERT-In has outlined a set of defensive principles, including zero-trust architecture, defence-in-depth strategies, secure-by-design development, and continuous monitoring of digital environments. It has also emphasised stronger governance over AI deployments and improved visibility into system behaviour.

The advisory calls for organisations to adopt continuous vulnerability management practices and prioritise remediation based on risk exposure. Known exploited vulnerabilities in internet-facing systems must be fixed within 12 hours where applicable.

Other recommended timelines include:

·         Critical external vulnerabilities: within 1 day

·         Internal exploited vulnerabilities: within 1 day with documented mitigation

·         High-value internal systems: within 3 days

·         High-severity issues: within 5 days based on risk

Where patches are unavailable, organisations are advised to apply temporary safeguards such as system isolation, access restrictions, API protection, enhanced monitoring, or feature disabling until fixes are released.

CERT-In further urged organisations to strengthen cyber resilience through regular audits, penetration testing, red teaming, and supply chain security checks using SBOMs and provenance validation.

The updated framework follows earlier warnings from CERT-In about the misuse potential of advanced AI models, which could lower barriers for attackers and significantly scale cyber operations globally.