India Mandates 12-Hour Patch Deadline Amid AI-Driven Cyber Threats

India's CERT-In has issued a directive requiring organizations to patch critical vulnerabilities on internet-facing and crown-jewel systems within 12 hours of discovery or active exploitation. This guidance responds to the accelerated pace of AI-assisted cyber-attacks, which have reduced the time available for defenders to react. The new framework categorizes vulnerabilities into tiers, with specific timelines: 1 day for critical external flaws, 3 days for internal criticalities, and 5 days for high-severity issues. Organizations are advised to implement interim measures if no patch is available. The blueprint emphasizes the need for robust governance, zero-trust architecture, and AI-aware security operations. This aggressive timeline reflects a significant shift in India's cybersecurity policy, aiming to enhance vulnerability management and threat intelligence integration. However, skepticism remains regarding the feasibility of such rapid patching, given historical compliance challenges.

Key Points: • CERT-In mandates a 12-hour patching deadline for critical vulnerabilities. • AI-driven attacks are compressing response times, necessitating faster remediation. • Organizations must adopt a risk-based approach to vulnerability management.