India's cybersecurity agency, CERT-In, has issued a new blueprint that significantly raises the bar for vulnerability remediation, demanding a shift from human-speed to machine-speed risk operations. This directive, released on May 25, 2026, mandates the containment of known exploited vulnerabilities on internet-facing and critical systems within 12 hours. This requirement stands in stark contrast to India's average breach lifecycle, which, according to IBM, is 263 days, creating a substantial operational and compliance risk for Indian organizations.
The core of CERT-In's updated expectations, detailed in Section 9 of its "Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure," focuses on rapid response to exploitable weaknesses. For known exploited vulnerabilities on internet-facing and "crown-jewel" systems, the agency expects containment, patching, or mitigation within 12 hours. Critical externally exposed vulnerabilities and known exploited vulnerabilities on internal systems must be addressed within one day, while critical internal vulnerabilities on high-value systems have a three-day window. Even for high-severity vulnerabilities, a five-day remediation period is stipulated, based on risk prioritization. When a patch is unavailable, organizations are expected to deploy temporary mitigations such as isolation, access restriction, Web Application Firewall (WAF) or API protection, enhanced monitoring, or feature disablement.
This new regulatory landscape is driven by the emergence of "Mythos-class" AI, which represents a fundamental change in how vulnerabilities are discovered and exploited. Unlike traditional vulnerability scanners that match known CVEs against software versions, these advanced AI models can read code, hypothesize, test, debug, and generate working exploits. This capability allows attackers to weaponize known, unpatched weaknesses at machine speed. While specific models like Anthropic's Mythos 5 and Fable 5 were subject to US export control directives on June 12, 2026, suspending access for foreign nationals, the underlying threat remains. Anthropic has stated that comparable capabilities exist in publicly accessible models like GPT-5.5, which has been found to perform comparably to Mythos Preview on expert cyber benchmarks. Furthermore, the potential for similar capabilities to emerge in open-source models within an estimated 12-18 months means that access control will become increasingly difficult.
The implications for India are significant, given its substantial cybersecurity threat landscape. CERT-In data indicates over 2 million cybersecurity incidents between 2021 and mid-2025. Current attack trends show rising ransomware-as-a-service victim counts, preferred entry points via vendor portals and supply chains, DDoS campaigns targeting critical infrastructure, and advanced persistent threat (APT) groups employing sophisticated techniques against defense and critical sectors. The banking, finance, healthcare, and hospitality sectors remain the most affected. Notably, most successful attacks exploit known vulnerabilities, unpatched systems, cloud misconfigurations, and vendor access paths rather than novel zero-days.
The economic impact of breaches in India is substantial, with IBM estimating the average cost at ₹22 crore. The emergence of "Shadow AI" has also been identified as a significant cost driver, adding an average of ₹1.79 crore to breaches. Despite this, a concerningly low 42% of Indian organizations reported having policies to manage AI or detect Shadow AI use. This situation now directly conflicts with CERT-In's stringent remediation timelines, alongside existing obligations from the Reserve Bank of India (RBI) and the Securities and Exchange Board of India (SEBI), the Digital Personal Data Protection (DPDP) Act breach notification requirements, and potential penalties up to ₹250 crore.
The critical challenge for Indian CISOs lies in bridging the gap between their current security operating models and CERT-In's new demands. The traditional approach, often characterized by weekly change advisory boards and multi-week patch cycles, is fundamentally misaligned with the 12-hour remediation requirement. The blueprint necessitates a shift towards a continuous, closed-loop Risk Operations Center (ROC) model that operates at machine speed. This involves automated detection, prioritization, validation, remediation, and proof of closure.
Meeting these expectations requires a fundamental re-evaluation of how organizations manage cyber risk. The focus must shift from merely closing tickets or generating static compliance documentation to providing verifiable evidence of exploit-path closure. This necessitates hyper-prioritization of vulnerabilities based on exploitability and business impact, safe and automated validation of remediation efforts, and the capacity for autonomous remediation where feasible. The ultimate goal is to achieve continuous validation and evidence of closure, ensuring that defenses are robust and responsive to the evolving threat landscape.
