India’s national cybersecurity agency has just told every enterprise in the country something that most security leaders have not yet fully internalised: the attack window between vulnerability disclosure and active exploitation has collapsed. Not shortened. Collapsed.

The Computer Emergency Response Team of India (CERT-In) published a 38-page cybersecurity blueprint this week mandating that organisations patch critical vulnerabilities in internet-facing systems within 12 hours of detection, wherever feasible. The requirement, framed as guidance rather than a hard directive, is nevertheless the most significant shift in India’s vulnerability management posture since the CERT-In Directions of 2022. And the reason for it tells you everything about where cybersecurity is heading in 2026.

The AI Problem CERT-In Is Responding To

The blueprint is explicit about what drove it. Threat actors are increasingly using AI tools and large language models to compress every stage of the attack chain from identifying exposed attack surfaces, to analysing exploitability, to generating weaponised code, to automating the actual attack. What previously required days of skilled manual work can now be done in hours by a moderately capable attacker with access to the right AI toolchain.

“AI-assisted cyber exploitation reduces the time required for adversaries to identify, weaponise, and exploit vulnerabilities, exposed services, weak identities, insecure APIs, and misconfigured systems,” the blueprint states. The document goes further: organisations should now anticipate that exploitation timelines will continue to collapse, and that attacks may eventually become fully autonomous.

This is not speculative. Security researchers have documented multiple cases in 2025 and 2026 where the interval between vulnerability publication and active exploitation in the wild was measured in hours, not days. The traditional 30-day patching cycle was already inadequate. The 72-hour emergency patch window that many security teams treated as their real-world standard is now too slow for the class of threat CERT-In is describing.

What 12 Hours Actually Means in Practice

The 12-hour window applies to internet-facing systems with critical vulnerabilities. It does not apply to every patch across the entire estate. But meeting that window requires organisations to fundamentally change their patching infrastructure, not just their timelines.

A team that receives a critical CVE notification at 9pm on a Tuesday and needs to patch a customer-facing system by 9am Wednesday is not dealing with a patching problem. It is dealing with an organisational readiness problem — one that touches on change management approvals, out of hours staffing, automated patch testing pipelines, and rollback procedures.

CERT-In acknowledges this, explicitly recommending temporary mitigations — isolation, access restriction, or feature disablement as an acceptable first response when immediate patching is not operationally feasible. The 12-hour target, in practice, means “achieve containment within 12 hours” rather than “deploy a fully tested production patch within 12 hours.”

The Broader Framework

Beyond patching, the blueprint outlines several principles that Indian security teams should incorporate immediately:

• Zero trust by default: Enforce continuous verification and least privilege access across all environments, particularly cloud and hybrid infrastructure.
• AI system visibility: Organisations running AI-enabled platforms must maintain active monitoring of those systems — not just for external attacks, but for prompt injection, model manipulation, jailbreaking, and training data poisoning from within.
• Anticipate breach: CERT-In’s language has shifted from breach prevention to breach readiness “anticipate a breach and prepare for rapid detection, containment, and recovery.”
• Supply chain scrutiny: AI-enabled attacks increasingly target software supply chains and CI/CD pipelines, requiring organisations to extend their security posture well beyond their own network perimeter.

What This Means for Indian Enterprises

For organisations operating under the DPDP Act 2023, the implications are direct. Section 8(5) requires “reasonable security safeguards” — and a CERT-In blueprint explicitly calling for 12-hour patching will become the reference standard for what “reasonable” means in a post-AI regulatory environment. An organisation that experiences a personal data breach through an unpatched vulnerability that remained exploitable for 72 hours will face difficult questions from the Data Protection Board.

The 12-hour mandate is not a compliance box to check. It is CERT-In telling the market: the AI threat has arrived, it is operating at machine speed, and your security operations must match that tempo or accept that you are permanently exposed.

Source: CERT-In Cybersecurity Blueprint, published May 26 2026.