CERT-In sets six-hour reporting deadline for AI security incidents
Source Entity
The Indian Express
India's cybersecurity agency, CERT-In, has issued urgent warnings regarding an AI-driven hacking group called 'Crafty Falcon' targeting fintech and crypto firms. New regulations now mandate a strict six-hour reporting window for all AI-related security incidents to mitigate escalating risks.
The Rise of AI-Enabled Cyber Warfare: India’s Strategic Response
India’s national cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has issued a critical warning regarding an escalating cyber-offensive by a threat actor designated as “CRAFTY FALCON.” This group is leveraging artificial intelligence to target the Banking, Financial Services, and Insurance (BFSI) sector, with a specific focus on cryptocurrency exchanges, non-banking financial companies (NBFCs), and digital lending platforms. The shift toward AI-assisted attacks represents a dangerous evolution in the threat landscape, as these tools allow adversaries to conduct reconnaissance and execute attacks at “machine speed,” leaving defenders with minimal reaction time.
Understanding the ‘CRAFTY FALCON’ Threat
The CRAFTY FALCON campaign, which CERT-In first identified in October, has demonstrated a sophisticated ability to infiltrate financial entities by exploiting their own automated systems. By using AI to survey targets, the threat actor can identify vulnerabilities and siphon funds or steal critical wallet keys with unprecedented precision. The persistence of these attacks, even against entities that had previously implemented remediation measures, highlights the limitations of traditional security frameworks when facing adaptive, AI-driven adversaries.
New Regulatory Mandates: The Six-Hour Rule
In direct response to this surge in AI-powered malice, CERT-In has introduced stringent new guidelines for government agencies and private companies. Central to these mandates is a six-hour reporting deadline for any AI-related security incidents. This requirement is an extension of the broader cybersecurity directions established in 2022, signaling a move toward real-time accountability in the digital infrastructure. By forcing organizations to disclose breaches within such a narrow window, the government aims to contain the “active and ongoing” threat before it can cascade through the broader financial ecosystem.
Broader Implications for AI Security
The new guidelines do not stop at reporting; they introduce a requirement for rigorous risk assessment, continuous monitoring, and independent verification of AI systems. This is particularly relevant for autonomous AI agents—systems capable of making decisions and executing tasks with limited human intervention. As these agents become more integrated into the financial sector, their potential to be weaponized or manipulated grows. The regulatory framework now seeks to standardize the security of these autonomous systems, effectively treating them as high-risk infrastructure.
Future Trends and Resilience
The escalation of the CRAFTY FALCON campaign serves as a harbinger for the future of cyber warfare. As AI tools become more accessible to malicious actors, the defense must shift from reactive to proactive, automated security postures. The emphasis on independent verification and standardized auditing suggests that the Indian government is preparing for a long-term conflict in the digital domain. Moving forward, the resilience of India's fintech sector will depend heavily on the ability of firms to align their AI deployments with these new, rigorous security standards and the speed at which they can integrate AI-driven threat detection into their existing operations.