For most of the last decade, India’s cybersecurity conversation has stayed within familiar territory. Phishing scams, ransomware locking hospital systems, data breaches are all real, ongoing problems, and the security ecosystem has at least developed a working vocabulary for responding to them. What is taking shape now sits in a different category entirely.
It is not about extracting data or demanding ransom. It is about engineering failure directly into the systems that keep a modern society running.
From Opportunistic Attacks to Engineered Disruption
The difference between the two is not just technical. A ransomware attack finds a gap, exploits it, and makes its presence known immediately. An engineered systemic attack works differently. It embeds itself quietly, often into firmware, supply chain components, or industrial control environments, and it waits. There is no ransom note. The goal is disruption, timed for maximum operational damage.
India’s digitization drive has created exactly the kind of interconnected environment where this becomes dangerous. Smart city deployments, 5G networks, IoT devices spread across energy grids, water systems, transport networks, and factory floors were built to be connected and efficient. Most were not built to withstand an adversary who has months or years to study them before acting.
The convergence of operational technology with information technology makes this worse. Industrial control systems and SCADA environments that once ran in isolation are now networked into the broader IT stack. What enters through a software vulnerability can, under the right conditions, reach the physical systems controlling a substation or a pipeline. That pathway has been demonstrated in real incidents abroad. Assuming India sits outside that risk category is not a position supported by evidence.
What AI Has Added to the Problem
Artificial intelligence has changed the calculus on the attacker’s side in ways that are only beginning to be understood. Reconnaissance that once took weeks can now happen in hours. Social engineering attempts are more personalized and harder to detect as fraudulent. Attack frameworks can probe defenses, register what fails, and adapt in near real time. The signature-based detection tools that form the backbone of most security operations were not designed to handle that kind of dynamic adversary.
The deeper risk, though, is not AI as an attack tool but AI as an attack target. A predictive maintenance model governing industrial equipment, fed manipulated inputs over time, may not raise an alarm when it should. The system continues to report normal conditions while the underlying equipment moves toward failure. There is no intrusion to detect in the conventional sense. The damage is done through misdirection rather than breach.
Where the Risk Is Hiding
Supply chain security is the area where Indian policy has the largest gap between awareness and action. No software patch applied after installation resolves a compromise that was built in before the device ever arrived.
The question of what is in a system before it is switched on is one that national security frameworks have historically been slow to ask. That slowness is becoming harder to afford.
The Case for Resilience Over Reaction
Indian cybersecurity policy has largely been shaped by incidents. An attack happens, attention follows, investment comes after. For engineered systemic threats, that sequence is not viable. By the time the incident occurs, the groundwork for it may have been laid years earlier.
The alternative is designing infrastructure to withstand failure rather than only to prevent breach. Redundancy, operational continuity planning, and recovery capability need to be treated as structural requirements, not supplementary features. Cybersecurity criteria should enter the process at procurement, not at audit. Major national programmes in digital infrastructure should carry resilience standards with teeth, not advisory guidelines that organizations check off and move past.
Threat intelligence sharing between private infrastructure operators and government agencies also remains shallow. The organizations running power grids, telecom networks, and financial systems sit on information that is genuinely valuable for national defense. The frameworks for sharing it, at speed and at the level of operational detail that matters, are not yet functioning as they need to.
The Expertise That Does Not Yet Exist at Scale
India does not have enough professionals who specialize in operational technology security, AI security, or the intersection of physical and digital systems. The existing pipeline skews heavily toward IT security and compliance work. Compliance itself is part of the structural problem. When the objective is satisfying an audit rather than building genuine resilience, organisations learn to perform security rather than practice it.
The governance layer needs to keep pace with the technology layer. As AI-driven monitoring and autonomous response systems move into critical infrastructure, the questions of oversight, accountability, and what happens when an automated system makes the wrong call need answers before those systems are widely deployed, not after.
India is building its digital infrastructure at genuine scale. That is worth doing. But the cost of building it without adversarial resilience baked in from the start is a cost that does not show up immediately. It shows up later, when the failure is harder to recover from and the decisions that created the vulnerability are long in the past.
(The author is the Co-founder and Chief Architect at [x]cube LABS)
Disclaimer: The opinions, beliefs, and views expressed by the various authors and forum participants on this website are personal and do not reflect the opinions, beliefs, and views of ABP Network Pvt. Ltd.
