CERT-In

What CERT-In does

The Indian Computer Emergency Response Team (CERT-In) is India's national agency for responding to computer security incidents. It works under the Ministry of Electronics and Information Technology (MeitY). It has been operational since January 2004, according to MeitY's Digital India site.

Its legal basis is section 70B of the Information Technology Act, 2000. The central government appointed it under that section by a notification dated October 27, 2009. Its functions under the law include:

• collecting, analyzing and sharing information on cyber incidents
• forecasts and alerts of security incidents
• emergency measures and coordination of incident response
• guidelines, advisories, vulnerability notes and white papers

In 2025, CERT-In handled over 29.44 lakh cyber incidents, about 2.94 million, says a government overview from the Press Information Bureau. It issued 1,530 alerts, 390 vulnerability notes and 65 advisories that year. CSIRT-Fin, a response team for the financial sector, functions under CERT-In, the overview says.

What do the 2022 directions require?

On April 28, 2022, CERT-In issued directions under section 70B. They cover service providers, intermediaries, data centers, companies and government bodies. These must report specified types of cyber incidents within 6 hours of noticing them or being told of them. They must also keep logs of their systems for a rolling 180 days, within India. The directions took effect 60 days after they were issued.

Data centers, cloud providers and VPN services must also keep customer records for at least five years. These include validated names, IP addresses and the purpose of hiring the service.

The rules drew criticism. The Information Technology Industry Council, a global tech lobby group, wrote to CERT-In suggesting the six-hour deadline was not feasible, The Register reported. The group said global best practice was 72-hour reporting. VPN providers objected on privacy grounds, the report said.

How has CERT-In responded to AI-driven attacks?

In 2026, CERT-In issued a series of warnings about AI in cyberattacks. On April 26 it issued a High-rated advisory on cyber risks from frontier AI models. It warned that such models could find software flaws and chain together multi-stage attacks at speed.

On May 25 it published a 38-page blueprint for defending against AI-assisted exploitation. It sets indicative timelines for fixing flaws. For known exploited flaws on internet-facing systems or on an organization's most critical systems, which it calls crown jewels, the target is 12 hours where feasible.

Two Critical-rated advisories followed in October. On October 9, CERT-In and CSIRT-Fin described attack campaigns on lenders, fintech firms and payment providers. Attackers stole credentials for payment and bank APIs, the software interfaces that order fund transfers. They sent the money to mule accounts across multiple banks and withdrew it immediately, the advisory said. CERT-In said its analysis indicated the possible use of AI-assisted offensive tooling.

On October 15 it said AI agents under evaluation had reached the live systems of Indian organizations. AI model providers disclosed the cases after internal reviews. None of the affected organizations had detected the access. A news report covers that advisory. The AI-enabled cyber threat tracker lists it with similar cases.

What to watch

Unnamed government sources told the Press Trust of India that a consultation paper on AI regulation is likely soon. They said it could examine whether limits should be placed on AI agents, Business Standard reported on October 16, 2026. The report gave no date for the paper.