India's Data Security Council releases AI accountability guide for Indian enterprises

The main drawback of integrating artificial intelligence into daily workflows is that critical protective mechanisms are implemented only after the technology has become deeply entrenched in operations. Companies and specialists hastily integrated generative tools into their operations from the outset, treating data governance and user privacy as secondary concerns.

As a result, modern reactive security measures resemble a sticker placed over growing structural cracks rather than a robust and comprehensive solution to the problem. This vulnerability is particularly noticeable among small and medium-sized enterprises (SMEs).

According to Microsoft's Data Security Index, a striking 32% of security incidents reported by surveyed businesses were directly linked to the use of generative AI.

Establishing defensive barriers after deployment has ceased to be merely an isolated operational issue; it has become a pervasive global dilemma affecting various industries and borders. Very few modern organizations remain untouched as leadership teams attempt to assess their true level of exposure within expanding digital footprints.

A Morgan Stanley 2026 study highlights this tension, showing that 90% of surveyed businesses identify corporate data as the primary source of operational risks, with 56% pointing to their internal AI tools as the driver of this risk. However, it is alarming that only 41% maintain strict, centralized tracking of active AI models along with designated departmental ownership.

Cybercriminals are deliberately targeting these institutional 'grey areas,' refining tactics designed to exploit the operational friction caused by uncontrolled AI adoption. Credential phishing remains the primary chosen weapon.

As noted in the Microsoft 2026 Digital Defense Report, compromised legitimate accounts now account for 20% of all initial breaches into corporate networks. The report emphasizes a fundamental truth: artificial intelligence does not change the traditional foundations of security—it simply provides adversaries with a faster and more scalable way to exploit familiar organizational weaknesses.

When a single corporate profile connected to an AI workspace is breached, every proprietary file, client record, or strategic document ever entered into that ecosystem instantly becomes accessible to attackers.

Historically, individual employees represented the weakest link in an organization's defensive perimeter. Deep reliance on everyday AI utilities only amplifies this human factor. When an employee takes a confidential spreadsheet from OneDrive and uploads it to an unverified personal AI assistant to meet an urgent afternoon deadline, they unknowingly bypass every firewall, access control, and internal policy designed to protect that intellectual property. Most often, this breach occurs without malicious intent or awareness of the long-term consequences for the business.

To counter this vulnerability, enterprises must immediately establish clear, enforceable boundaries defining which categories of data can interact with AI mechanisms, reinforce these policies with strict compliance checks, and establish clear intellectual property ownership.

Maintaining a disciplined balance between business insights fed into AI models and how deeply these platforms regulate daily work is one of the most pressing cybersecurity challenges facing leadership today—and this challenge will only intensify in the future.

Artificial intelligence is accelerating the process of discovering software vulnerabilities, reducing the time allocated for their remediation. Cybersecurity experts polled by Reuters predict new disruptions in digital services as companies and governments attempt to prepare for the exploitation of these flaws.

A study conducted by VulnCheck, scheduled for publication in the coming days, shows that the number of discovered digital vulnerabilities has doubled compared to the previous year. Issues registered this week on European government websites demonstrate the pressure such discoveries can cause.

Disruptions began on Wednesday after vulnerabilities were found in PHP, a programming language used in many parts of the internet. To prevent attacks, operators rushed to fix their systems. Some temporarily took sites offline because they could not apply updates before potential intrusions.

This race for fixes occurred during a week already marked by other security issues. Vulnerabilities were disclosed in Node.js and Plex, as well as incidents related to the AI platform LiteLLM and the development platform Railway. The Indian certification authority eMudhra also drew attention due to the use of an extremely weak cryptographic key, which could have jeopardized internet users.

Matthew Prince, CEO of Cloudflare, told Reuters that he is aware of other serious vulnerabilities in software critical to network operation. In his assessment, the sector will face difficult months ahead. He noted: 'I think we will have several years where it feels like the sky is falling every week.'

Previously, searching for vulnerabilities in complex programs required specialized knowledge. Developing tools to exploit them could take weeks or months, giving system administrators time to prepare fixes and distribute updates. However, artificial intelligence is shortening this timeframe. Models are capable of continuously analyzing large codebases, finding issues, and helping develop exploitation tools in just a few hours.

Shane Fry, CTO of RunSafe Security, emphasized the change in the pace of this process. He stated: 'What is fundamentally and undeniably changing is the time required both to discover vulnerabilities and for adversaries to be able to exploit them.'

In light of this situation, security teams must handle tasks that go beyond simply identifying code errors. Specialists are concerned about the reduced response time, but there is no consensus on whether accelerated vulnerability discovery will lead to a wave of successful attacks.

Daniel Steinberg, lead developer of the curl file transfer tool, notes that some vulnerabilities found by AI models are complex and difficult to exploit. Rami Rahman from security company ArmorCode also points out that publishing more vulnerabilities does not necessarily mean an increase in successful attacks. The PHP case serves as an example of this difference: threat intelligence firm Hunt.io discovered aggressive exploitation attempts but reported that by 2 PM Eastern Time on Thursday, the tracked attackers had apparently not yet managed to develop a functional tool to use this vulnerability.

Prince mentioned signs of intrusion related to the vulnerability. Nevertheless, he believes that accelerated problem discovery can bring long-term benefits by allowing the fixing of errors that have remained hidden for years.