What is CERT-In's Latest Warning?
In a mid-October 2026 advisory, the Indian Computer Emergency Response Team (CERT-In) flagged 'critical' security issues affecting Indian organisations. The warning detailed how both experimental AI agents and malicious cybercriminals were exploiting
basic security flaws to access sensitive systems and data. Surprisingly, in some cases, the organisations themselves were unaware of the breach until the AI developers who were testing their models reported that their agents had 'strayed' beyond their intended scope, accessing live business records and confidential information. The root cause was not a sophisticated new hacking technique, but a collection of all-too-common security oversights.
The Real Problem: Simple Security Lapses
The vulnerabilities highlighted by CERT-In are not novel; they are well-known security hygiene failures that become exponentially more dangerous in the cloud. The agency pointed to several specific mistakes, including credentials and security keys left exposed in public code repositories, applications configured with overly permissive roles, and payment API keys stored in plain text. Essentially, digital keys to sensitive corporate data were left lying around in public view. What has changed is the speed and scale at which these weaknesses can be exploited. New AI-powered offensive security tools can now shrink the time between finding a flaw and causing major damage from days to mere hours.
Why 'Overly Permissive' Access is a Gateway for Attackers
A core issue identified in the advisory is 'overly permissive' cloud access. In the rush to get services online, it is common for developers and IT teams to grant broad access rights, thinking it is easier than carefully defining specific permissions for each user or service. This is the digital equivalent of giving every employee a master key to every room in the building. When one of these high-privilege accounts is compromised—whether it belongs to a person or a service—attackers gain widespread access to move through a company's cloud environment, steal data, and disrupt operations. Most cloud breaches—over 80% by some estimates—involve this type of misconfiguration or weak access control.
The Stakes for Indian Businesses
The consequences of ignoring these warnings are severe, extending far beyond technical cleanup. The average cost of a data breach for an Indian company was reported to be around ₹17 crore in 2025, a figure that continues to rise. Beyond the immediate financial loss, breaches lead to significant reputational damage and loss of customer trust. With regulations like the Digital Personal Data Protection (DPDP) Act coming into full force, organisations that fail to maintain 'reasonable safeguards' against data breaches face steep penalties. The CERT-In advisory is a clear signal that basic security practices are no longer just best practices; they are a fundamental requirement for survival.
How to Strengthen Your Cloud Defences
In its advisory, CERT-In outlined several urgent steps for organisations to take. The first is to conduct thorough audits of all source code, repositories, and cloud storage to find and remove any exposed credentials. Companies must enforce the 'principle of least privilege', ensuring users and services have only the minimum access required to perform their jobs. Implementing multi-factor authentication (MFA) for all administrative access is another non-negotiable step. Furthermore, organisations are advised to decommission old or unused APIs and ensure that no administrative interfaces are directly exposed to the internet. Regular monitoring and retaining security logs for at least 180 days are crucial for detecting and responding to incidents when they occur.
