Phishing attacks getting sharper with AI, says CERT-In director Sanjay Bahl

Highlighting ongoing government efforts, Bahl said CERT-In regularly conducts cybersecurity drills to simulate attack scenarios.

Phishing attacks are becoming increasingly sophisticated with the use of artificial intelligence (AI), according to Sanjay Bahl, director general of the Indian Computer Emergency Response Team (CERT-In).

Speaking at a session during the Global Fintech Fest (GFF) 2025, Bahl cautioned that AI is now being weaponised by malicious actors to create highly convincing phishing attempts.

“Phishing attacks today are very much being used with AI, and it is increasing. Earlier, we could differentiate AI-generated content, now we can’t. Malicious actors are always the first to adopt new technologies, so this trend is bound to rise,” Bahl said, while responding to Moneycontrol’s queries.

He noted that continuous cybersecurity audits will become essential from 2026, urging companies to maintain an “inventory or bill of materials” for their AI, hardware, and software assets to better track vulnerabilities.

Bahl also called on organisations to start preparing for the era of quantum computing. “Everyone should start thinking about quantum. This is not like a Y2K issue. If you have hundreds of ecosystem partners, you need to monitor their preparedness too,” he cautioned.

Highlighting ongoing government efforts, Bahl said CERT-In regularly conducts cybersecurity drills to simulate attack scenarios.

“The drills are currently breaking or about to break. You have to ensure the right technology, updated processes, and trained people are in place,” he said, underscoring that AI-related risks require holistic readiness across technology, processes, and people.

CERT-In, under the ministry of electronics and information technology, is India’s nodal agency for responding to cybersecurity incidents and strengthening the defence of the country’s digital infrastructure.

The cybersecurity watchdog recently made cybersecurity audits compulsory for MSMEs in India.

The new MSME-specific framework offers a minimum cybersecurity baseline, complementing July’s sweeping audit mandate for all organisations.