"India's cybersecurity architecture is largely reactive, responding to breaches after disclosure." Critically examine this statement in light of the rise of agentic AI.

India's cyber defence rests on CERT-In, the national incident-response agency under Section 70B of the IT Act, 2000 [2]. Incidents rose from about 20.4 lakh in 2024 [2] to over 29.4 lakh in 2025 [3], and agentic AI is shortening the time attacks take. Against this background, the charge that the system is reactive is largely valid, though not wholly.

Why the statement holds

• Reporting starts only after detection: CERT-In's 2022 Directions require incidents to be reported within 6 hours of being noticed [6]. The duty begins only when an entity detects the incident, and many entities lack the capacity to detect it.
• Penalties not yet enforceable: The DPDP Rules, 2025 are being rolled out in phases over 18 months [1]. Until then, penalties of up to ₹250 crore for weak security safeguards cannot be imposed [1].
• Little public learning: CERT-In was placed in the RTI Act's Second Schedule in 2023 [5]. It also does not publish post-mortems of incidents, which weakens public accountability.
• Legal lag: IT Act liability assumes a human actor. AI agents that act beyond their authorised limits fall into a legal grey zone.

Where it is overstated

• Preventive outputs: In 2025, CERT-In issued 1,530 alerts, 390 vulnerability notes and 65 advisories [3].
• Early warnings: CERT-In's high-severity advisory warned that autonomous AI could find vulnerabilities and run multi-stage attacks, before any large-scale harm occurred [4].
• Duties before a breach: The DPDP framework requires reasonable security safeguards. It also requires plain-language breach notice to the Data Protection Board and to each affected person [1].

Agentic AI makes a reactive approach costlier

• AI agents act at machine speed, so by the time a breach is detected and reported, the data may already be gone.
• Open-source agent tools let low-skill actors automate reconnaissance. They still mostly exploit basic lapses such as exposed passwords.

Way forward

• Continuous threat-hunting, and testing of AI agents only in isolated environments, never on live infrastructure.
• Make developers liable for their agents' actions through the proposed Digital India Act.
• Publish anonymised post-mortems of major incidents.
• Cyber-hygiene support for MSMEs before DPDP duties take full effect.

India has built the necessary laws and institutions, but its system still acts mainly after a breach is disclosed. It needs a regime that puts detection first and accounts for AI risks: a transparent CERT-In, enforceable DPDP safeguards and clear liability for AI agents. Such a regime would protect the Article 21 right to privacy affirmed in Puttaswamy (2017) and maintain trust in India's digital economy.