Why AI should be embedded in India’s national cyber defence strategy

By Dr. Srinivas Mukkamala, CEO, Securin

India is one of the fastest-growing digital economies on earth — Digital India, UPI, Aadhaar, hundreds of millions of people transacting online every day. That scale is India’s strength, and increasingly, its exposure. Cyber incidents reported in India are now climbing into the hundreds of millions annually, with losses running into tens of thousands of crores. Ransomware, fraud, and supply-chain attacks aren’t occasional anymore. They’re constant.

I’ve spent decades in this fight, contributing to the U.S. Department of Defense cybersecurity programs, and now leading Securin. What I’ve learned over that time is simple: the question for India isn’t whether to bring AI into cyber defense. It’s how fast, and how deep.

Attackers already have the advantage
Adversaries are weaponizing AI today. State actors and criminal groups are using it to find vulnerabilities, write exploit code, chain attacks together, and generate convincing phishing content and deepfakes — at a speed no human team can match. Work that took a skilled attacker weeks now takes hours. CERT-In has already flagged this compression of attack timelines in its advisories.

India’s exposure is real and specific: power grids, telecom, finance, transport, and nuclear infrastructure are all live targets, as are the digital public goods like UPI, Aadhaar, DigiLocker, that Digital India runs on. The asymmetry is what makes this hard: an attacker needs to find one way in, while defenders have to close every door. That math has never favored the defense. AI is the only thing that changes it.

Sovereign AI is not optional
Sovereign AI means India builds and controls its own models, data, and compute for national security use cases, rather than routing critical defense infrastructure through tools it doesn’t own or fully understand. Dependence on foreign AI systems for this work isn’t just a supply-chain question. It’s a backdoor risk and a strategic exposure India can’t afford at the infrastructure layer.

That means AI trained on India-specific threat intelligence — the vulnerability patterns, attack vectors, and infrastructure realities that generic global models don’t capture. It means data sovereignty and explainability built into high-stakes cyber tools from day one, not bolted on after an audit. And it means reducing reliance on external clouds that could be throttled, compromised, or simply unavailable in a crisis, which is exactly the moment they’d be needed most.

The foundation already exists
India doesn’t need to invent this capability — it needs to point to what already exists at cyber defense and scale it. The IndiaAI Mission is building compute capacity and indigenous models. AIGEG is coordinating AI policy nationally. CERT-In’s AI advisories and initiatives like the CyberGuard hackathons are already building skills on the ground.

A refreshed National Cyber Security Strategy should connect these pieces deliberately: linking CERT-In, the Defence Cyber Agency, and NCSC through AI-enabled command centers; mandating AI-enhanced monitoring in critical sectors; and backing public-private partnerships that build sovereign threat intelligence rather than importing it.

The window is now
AI-powered adversaries aren’t waiting for India’s policy cycle to catch up. Every quarter of delay widens the gap between attacker and defender capability. India has the digital scale, the technical talent, and, increasingly, the policy appetite to lead on this rather than follow it. Embedding sovereign AI into national cyber defense now protects 1.4 billion citizens today, and positions India to export trusted AI-cyber solutions tomorrow.

-Dr. Srinivas Mukkamala is CEO of Securin, founder of RiskSense, and an advisor on national AI and cyber policy