CERT‑In Sets a 12‑Hour Clock on Patching After AI‑Assisted Exploits

India’s Computer Emergency Response Team (CERT‑In) released a fresh advisory this week urging organisations to patch, mitigate or cut off exposure within 12 hours when a vulnerability that is known to be exploited affects an internet‑facing or “crown‑jewel” asset. For less critical flaws – for example a CVSS 9.0+ issue on an internal system – the agency still allows a 24‑hour window.

---

Legal Basis: Why the Clock Matters

The guidance is not a law, but it aligns with several regulatory regimes that already impose strict timelines on vulnerability remediation:

• GDPR (EU) – Articles 32 and 33 require controllers and processors to implement "appropriate technical and organisational measures" and to "communicate a personal data breach to the supervisory authority within 72 hours". A failure to patch a known exploited vulnerability that leads to a breach can be interpreted as insufficient technical protection, exposing firms to fines of up to €20 million or 4 % of global turnover.

• CCPA / CPRA (California) – The California Privacy Rights Act obliges businesses to maintain reasonable security. The Attorney General’s office has begun treating delayed patching of known exploits as a "failure to implement reasonable security" and can levy civil penalties of $2,500 per violation (or $7,500 for intentional violations).

• India’s Personal Data Protection Bill (PDPB) – Although still pending final enactment, the draft mirrors GDPR’s accountability principle and envisages penalties of up to ₹250 crore for non‑compliance. CERT‑In’s advisory will likely be treated as an industry‑wide standard of “reasonable security” under the future law.

By codifying a 12‑hour target for the most dangerous exposures, CERT‑In is effectively setting a benchmark that regulators may reference when assessing whether an organisation met its statutory duty of care.

---

Impact on Users and Companies

For Users

• Reduced breach risk – Faster containment means fewer opportunities for attackers to exfiltrate personal data, limiting the chance of identity theft, financial loss, or reputational damage.
• Potential service interruptions – Companies may need to temporarily isolate services to meet the deadline, which could cause brief outages. Transparent communication will be key to maintaining trust.

For Companies

• Operational pressure – Patch management teams must rethink their workflows. Traditional “test‑then‑deploy” cycles often exceed 12 hours, especially for legacy systems.
• Need for automated mitigation – The advisory explicitly allows “patch, mitigate, or remove exposure”. Temporary controls—network segmentation, firewall rule changes, disabling vulnerable APIs—become a legal‑safe harbour while a full fix is prepared.
• Compliance monitoring – Enterprises with EU or California data subjects will need to map CERT‑In’s timeline to GDPR/CCPA breach‑notification deadlines. Missing the 12‑hour window could be cited as evidence of inadequate security in regulator investigations.
• Financial exposure – Beyond regulatory fines, insurers are beginning to tie cyber‑policy premiums to demonstrated patch‑speed. Companies that consistently meet the 12‑hour target may qualify for lower rates.

---

What Changes Are Required?

1. Automated Vulnerability Detection

Deploy tools that ingest the CISA Known Exploited Vulnerabilities (KEV) catalog, the Indian CERT‑In KEV feed, and commercial threat‑intel sources in real time. Integration with Security‑Orchestration‑Automation‑Response (SOAR) platforms can generate tickets instantly.

2. Pre‑Approved Containment Playbooks

Create playbooks that, at the moment a critical exploit is identified, can automatically:

• Block inbound traffic to the vulnerable service.
• Enforce least‑privilege access for the affected account.
• Deploy a temporary runtime patch (e.g., a Web Application Firewall rule). These actions satisfy the “mitigate or remove exposure” clause without waiting for a full software update.

3. Continuous Testing Pipelines

Shift left: embed vulnerability scans into CI/CD pipelines so that a patch is already built and tested before a vulnerability is publicly disclosed. Tools such as GitHub Dependabot, Snyk, or OWASP Dependency‑Check can automate this step.

4. Cross‑Functional Incident Response

The advisory stresses that “the enterprise functions of the business” must join security. Establish a rapid‑response liaison team that includes:

• IT operations
• Application owners
• Legal/compliance
• Communications This team can make quick decisions on isolation versus full patching, balancing security with business continuity.

5. Documentation for Regulators

Maintain an audit trail that records:

• Detection time of the exploited vulnerability.
• Decision point (patch, mitigation, or isolation).
• Timestamp of the action taken.
• Evidence of testing or risk assessment. Such logs will be invaluable if a data‑protection authority questions the adequacy of your response.

---

Is a 12‑Hour Deadline Realistic?

Industry veterans acknowledge the target is aggressive. However, the guidance is conditional – it applies where feasible and permits temporary mitigations. In practice, organisations that have already invested in automated detection and pre‑approved containment can meet the deadline without sacrificing stability.

A recent survey of Indian enterprises (TechInsights, June 2026) found that 38 % could apply a mitigation within 6 hours, while only 12 % could fully patch within the same window. The gap underscores the need for a two‑track approach: rapid containment first, full remediation second.

---

Bottom Line

CERT‑In’s 12‑hour recommendation is a clear signal that AI‑driven threat actors are compressing the attack life‑cycle. Companies that ignore the clock risk not only technical compromise but also regulatory penalties under GDPR, CCPA and the forthcoming Indian data‑protection law. The practical path forward is to automate detection, pre‑authorise mitigations, and embed cross‑functional response teams so that the clock starts ticking the moment an exploit is confirmed.

By treating the 12‑hour window as a minimum standard of reasonable security, organisations protect their users, avoid hefty fines, and stay ahead of the AI‑enabled attackers that are reshaping the cyber‑threat landscape.