India’s AI security framework signals a shift from technology adoption to accountability, requiring organisations to strengthen exposure management, identity security, continuous monitoring and risk-based auditing as autonomous AI systems expand across enterprise environments.
India’s artificial intelligence (AI) ecosystem is entering a new phase of regulatory scrutiny. As enterprises accelerate the deployment of generative AI, large language models (LLMs) and autonomous AI agents, cybersecurity accountability is becoming as important as innovation and adoption.
The Indian Computer Emergency Response Team (CERT-In), under the Ministry of Electronics and Information Technology (MeitY), has taken a significant step in this direction with its Artificial Intelligence (AI) Security Auditing Guidelines, Version 1.0, released on November 4, 2026.
The guidelines introduce a structured, risk-based approach to auditing AI systems, placing greater emphasis on security accountability, independent assessments, continuous monitoring and organisational preparedness.
More importantly, they underline a fundamental shift in enterprise cybersecurity priorities: organisations must move beyond identifying vulnerabilities to understanding which security exposures can cause the greatest business damage.
This distinction is critical as AI systems become increasingly interconnected with enterprise applications, cloud infrastructure, customer databases, identity platforms and business-critical workflows. A compromised AI model or an inadequately secured autonomous agent could potentially expose sensitive information, manipulate business decisions or provide attackers with access to privileged enterprise environments.
“AI security can no longer be treated as an isolated technology issue. It must become an integral part of enterprise risk management.”
Four risk categories change the AI security equation
One of the important elements of CERT-In’s framework is its four-tier risk classification covering Low, Moderate, High and Critical AI systems.
The classification considers the potential consequences of an AI system malfunctioning or being compromised, the sensitivity of information it processes, its degree of autonomy, the scale of its impact and the reversibility of potential harm.
This approach introduces a more contextual understanding of cybersecurity risk.
Under conventional vulnerability management, security teams often prioritise weaknesses based on technical severity scores. However, an AI application with a moderate technical vulnerability could represent a critical business exposure if it has privileged access to financial systems, customer records or sensitive enterprise infrastructure.
Conversely, a technically severe vulnerability in an isolated system may have limited business consequences.
The new framework therefore reinforces the need to assess vulnerabilities in the context of business criticality, exploitability, exposure and the operational authority granted to AI systems.
For CISOs, this means security prioritisation must increasingly reflect the potential business consequences of an attack rather than simply the number or severity of vulnerabilities identified.
Agentic AI introduces a new attack surface
The emergence of agentic AI makes this transition particularly urgent.
Unlike conventional AI assistants that primarily generate responses, autonomous AI agents can plan activities, invoke external tools, interact with enterprise applications and execute tasks with varying degrees of autonomy.
When connected to business systems, these agents may gain access to sensitive information, application programming interfaces (APIs), cloud resources and privileged workflows.
This creates new security challenges, particularly when agents operate with excessive permissions or insufficient human oversight.
CERT-In’s October 15, 2026 advisory, AI Agents as Attack Vectors: Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets, highlighted incidents involving AI models accessing live systems belonging to Indian organisations during research and evaluation activities.
The reported incidents involved access to business records, personal information and confidential material through exposed credentials, configuration weaknesses and overly permissive cloud roles.
The advisory also highlighted the growing use of open-source agentic AI tools by financially motivated attackers for reconnaissance and exploitation.
Such developments challenge conventional enterprise security assumptions. AI agents must increasingly be treated as digital identities with defined privileges, access boundaries and accountability.
Organisations need to implement least-privilege access, dedicated identities, restricted API permissions and human approval mechanisms for consequential actions such as financial transactions, sensitive data access and critical configuration changes.
“Every autonomous AI agent is effectively another digital identity. Its access, permissions and activities must be governed as rigorously as those of human users.”
Nine audit domains expand the scope of cybersecurity
CERT-In’s framework extends beyond conventional technical vulnerability assessments through nine core audit domains.
These cover AI governance and accountability, data management and privacy, model risk management, ethics and fairness, explainability and transparency, security and adversarial resilience, continuous monitoring and drift management, human oversight, and third-party and AI supply-chain assurance.
The framework also addresses the security requirements of generative AI, retrieval-augmented generation (RAG), agentic AI, multimodal AI and multi-agent systems.
This wider scope is significant because vulnerabilities can originate anywhere within the AI ecosystem.
An exposed API, compromised training dataset, insecure third-party model or improperly configured cloud identity could create interconnected risks across enterprise environments.
Consequently, security assessments must encompass the entire AI lifecycle, including model development, procurement, deployment, integration, operation and eventual retirement.
Organisations also need to establish clear accountability for external AI providers and technology partners, particularly where sensitive business information is processed outside their direct infrastructure.
“The biggest AI security risk is not necessarily the vulnerability itself, but the business exposure it creates when combined with excessive permissions, sensitive data and autonomous decision-making.”
Why AI visibility must precede risk prioritisation
A major obstacle to effective AI security is the growing lack of visibility into how AI is being used across organisations.
While IT departments may deploy approved AI platforms, employees increasingly experiment with publicly available AI tools, browser-based assistants and third-party applications without formal security approval.
This phenomenon, commonly known as shadow AI, creates an unmanaged layer of enterprise technology.
Employees may inadvertently share confidential business information, customer records, source code and internal documents with applications that have not undergone security assessment.
Research cited by Tenable’s India leadership highlights the financial implications. According to figures referenced by Rajnish Gupta, Managing Director and Country Manager, Tenable India, shadow AI added an average of US$189,000 to the cost of a data breach in India. The same discussion cites research indicating that 35% of organisations lack policies to manage AI usage and prevent shadow AI.
The exposure extends beyond unauthorised applications.
Tenable’s Cloud and AI Security Risk Report 2026 highlights excessive permissions among non-human identities. Its reported findings indicate that 52% of non-human identities hold critical excessive permissions, compared with 37% of human identities.
This is particularly relevant as organisations introduce AI agents that interact with cloud platforms, databases, enterprise applications and automated workflows.
Without an accurate inventory of AI models, agents, APIs, identities and associated permissions, security teams cannot establish the organisation’s actual exposure.
“You cannot prioritise what you cannot see. AI discovery and exposure management must become the foundation of enterprise AI security.”
From vulnerability management to exposure management
CERT-In’s framework reinforces the need to move beyond traditional vulnerability management towards contextual exposure management.
Traditional vulnerability management frequently produces extensive lists of security weaknesses ranked according to technical severity. However, this does not always establish whether a vulnerability is exploitable within an organisation’s environment or whether it provides attackers with a pathway to critical business assets.
Exposure management addresses this gap by examining the relationships between vulnerabilities, misconfigurations, identities, permissions, internet-facing assets and business-critical systems.
Consider an AI agent connected to an enterprise customer relationship management platform. The agent may have access to customer records, application APIs and cloud storage. A vulnerability in one component might appear relatively insignificant in isolation. However, when combined with excessive permissions and an exposed API, it could create a pathway to sensitive customer information.
An exposure-based approach evaluates this interconnected risk rather than treating each weakness as an independent security issue.
For CISOs, the priority should be to identify vulnerabilities that are externally exposed, actively exploitable, connected to privileged identities or capable of providing access to sensitive information and critical applications.
The objective is not simply to reduce the number of vulnerabilities but to eliminate the exposures that create the greatest likelihood of business disruption, data compromise and operational damage.
This also makes cybersecurity investments more measurable. Instead of reporting only the number of vulnerabilities patched, security teams can demonstrate how much critical exposure has been eliminated.
Six-hour reporting deadline puts incident preparedness under scrutiny
Another important dimension of CERT-In’s framework is the emphasis on timely identification, escalation and reporting of AI-related cybersecurity incidents.
The six-hour reporting requirement builds on CERT-In’s existing cybersecurity directions issued in 2022. The framework also emphasises retaining security logs for at least 180 days and maintaining synchronised timestamps across AI components to support investigations.
Organisations need to preserve traceability across training datasets, model configurations, prompts, system changes and consequential AI actions.
These requirements become particularly important when investigating autonomous agents, where reconstructing the sequence of activities and identifying the source of unauthorised access can be challenging.
Security operations centres (SOCs) must therefore expand monitoring beyond conventional endpoint, network and application alerts.
They need visibility into unusual agent behaviour, unauthorised tool invocation, abnormal API usage, unexpected data access and attempts to bypass operational restrictions.
The reporting window also places pressure on incident response preparedness. Organisations need established escalation processes, clearly identified system owners, reliable security telemetry and tested incident response procedures.
Five priorities for enterprise security leaders
For Indian enterprises, translating the new framework into operational security practices should be an immediate priority.
1. Establish an enterprise-wide AI inventory
Identify approved and unauthorised AI systems, including internally developed models, third-party platforms, embedded AI capabilities and autonomous agents. Each system should have an identified business owner, purpose and risk classification.
2. Introduce risk-based prioritisation
Evaluate AI systems according to business impact, data sensitivity, autonomy, exposure and potential consequences of compromise. Map these risks against existing vulnerabilities, identities and infrastructure exposures.
3. Strengthen identity and access management
AI agents should operate with restricted permissions, dedicated identities and clearly defined operational boundaries. Review service accounts, API keys, cloud roles and non-human identities to eliminate excessive privileges.
4. Implement continuous security validation
AI systems should not be considered secure simply because they passed an initial assessment. Changes in models, datasets, prompts, configurations and connected applications can introduce new vulnerabilities. Periodic audits, adversarial testing and continuous monitoring are essential.
5. Strengthen audit and incident response readiness
Maintain evidence of risk assessments, security testing, model changes, access controls and remediation activities. Incident response teams must be prepared to investigate AI-related incidents and meet applicable reporting timelines.
These measures require collaboration between CISOs, CIOs, AI development teams, risk officers, legal departments and business owners. AI security can no longer remain the exclusive responsibility of technology teams.
The CISO’s role shifts from protection to exposure control
The larger significance of CERT-In’s new guidelines lies in the changing nature of enterprise cybersecurity accountability.
As AI becomes embedded in business operations, the traditional perimeter-based security model becomes increasingly inadequate. AI systems interact with multiple applications, data sources, cloud environments and external services. Their behaviour can change as models are updated, new tools are connected and additional permissions are granted.
This creates a dynamic risk environment that cannot be managed through periodic security assessments alone.
The CISO’s role is consequently evolving from protecting infrastructure to understanding and controlling the organisation’s entire digital exposure.
That includes knowing which AI systems are operating, what information they can access, which identities they use, what decisions they can make and how their actions can be monitored or reversed.
For Indian businesses, CERT-In’s framework provides an opportunity to bring AI adoption and cybersecurity governance onto the same strategic footing.
The real test, however, will be implementation. Organisations that treat AI auditing as a documentation exercise may end up with extensive compliance records but limited improvement in their actual security posture.
Those that integrate AI inventories, exposure management, identity security, continuous validation and risk-based prioritisation into everyday operations will be better positioned to manage the next generation of cyber threats.
Finally…
Ultimately, the question is no longer whether organisations have adopted AI, but whether they can demonstrate that they understand, measure and continuously control the risks created by every AI system operating within their digital environment.