Why speed is India’s next cybersecurity advantage

Every October, the cybersecurity industry asks Indian businesses to do the same handful of things: use strong passwords, turn on multi-factor authentication, patch on time, and watch out for phishing. This year’s Cybersecurity Awareness Month theme was ‘Don’t Make It Easy for Them’, set by the National Cybersecurity Alliance, and it rested on a reasonable premise: attackers succeed because defenders make small, avoidable mistakes, and those mistakes are avoidable precisely because there is usually enough time to catch them.

However, with Sophos’ report on AI-driven cyberattacks showing that time is exactly what attackers have taken away, I suggest this premise requires an urgent rethink.

From weeks to days

The Sophos report outlines a campaign tracked under the codename STAC6994. Inside a customer’s network, a threat actor ran what amounted to a live software development operation, deploying about 12 AI agents to write and test malicious code against three of the world’s leading endpoint protection platforms. In a matter of days, that operation produced nearly 80 attack modules and more than 70 evasion techniques, each one automatically refined and re-tested against live defences until it worked. As Sophos CTO John Peterson put it in the report, attackers still need to get in, still need to move sideways through a network, still need to get data out the door. What has changed is the clock. What used to take a skilled human attacker weeks now takes an AI-assisted operation days.

That is the central finding of the report: AI’s biggest impact on cybercrime right now is not new kinds of attacks. It’s speed.

The future is now

Any Indian business leader who assumes this won’t happen to their organisation, needs to think again. In July 2026, the Securities and Exchange Board of India issued a formal caution to regulated entities and listed companies about what it termed the “Boss Scam”: fraudsters impersonating CEOs and managing directors over WhatsApp, email, and Microsoft Teams, using AI-generated deepfakes and cloned voices to instruct finance teams to make urgent transfers. According to the advisory, victims, in some cases, are told to keep the transaction confidential by framing it as unpublished price sensitive information, a detail designed to discourage the one habit that actually stops this fraud: picking up the phone and calling the real person back on a known number. Attackers have also been documented hijacking a finance officer’s WhatsApp Web session through a malicious file, then contacting colleagues from an account that looks entirely genuine, in some cases renaming the compromised contact to the CEO’s or MD’s name.

When a market regulator issues a named, sector-wide caution about a specific impersonation technique, that is a reliable signal the technique has moved well past the experimental stage. It also happens to be a near-perfect illustration of the report’s core finding: none of the individual techniques here are new. Voice cloning, fake video calls and compromised messaging accounts have existed for years. What has changed is how quickly and cheaply an attacker can assemble them into a convincing, fast-moving attempt, and how little time a finance team has to catch it once it starts.

The perimeter has moved, and it moves at machine speed now

This is where the two halves of the report meet. Beyond speed, the second major finding is that enterprise AI identities, meaning OAuth tokens, coding agents, APIs, and the credentials that connect them, are becoming high-value targets in their own right, often with far less governance around them than the human logins security teams are used to protecting. Set that alongside identity now overtaking software vulnerabilities as the leading way ransomware gets into a network, and the picture for Indian enterprises comes into focus. The network edge, where most security budgets are still concentrated, is no longer where the real fight is happening. It has moved to identity—identity moving at machine speed.

That same speed test is starting to show up in Indian regulation too, even if it hasn’t yet reached identity governance inside most companies. The IT Amendment Rules that the Ministry of Electronics and Information Technology announced in February 2026 cut the deadline for platforms to take down unlawful or flagged synthetic content to as little as three hours, down from the 36-hour window under the earlier rules. That is regulators making the same admission this piece has been making about attackers: the old response timelines are too slow for how fast harm can now spread. Businesses need to apply that same standard internally, to identity and access, not just to content takedowns, and the ones who do it ahead of a mandate will be setting the pace rather than reacting to one.

What ‘difficult’ means today

While “Don’t Make It Easy for Them” is still the right instinct, making it difficult now means something different than it did even two years ago. A once-a-year phishing simulation and an annual password reset policy were built for a threat that moved at human speed. They are not built for threats that  move at machine speed. Instead, Indian enterprises need three things—verification built into every high-value approval, whether a wire transfer or a credential grant; real governance over every AI identity and API key an organisation has issued, tracked with the same rigour as a human employee's access; and detection and response capability that assumes an attacker may already be inside and executing in days, not weeks.

The businesses that get ahead of this shift now will be the ones setting the pace, rather than catching up to it. That is what “Don’t Make It Easy for Them” should mean for Indian enterprises.

(The author is MD and VP Sales, India and SAARC, Sophos. Views are personal.)