ET WLF 2026: Tech Inc calls for stronger AI governance to offset cyber threats

Indian enterprises and critical infrastructure operators must invest in strengthening artificial intelligence (AI) governance as autonomous agents significantly expand the cyber threat landscape, industry leaders said.

"Agents deployed for cybersecurity can handle many lower-level tasks such as triage, but organisations need to understand where these agents are being deployed, what they are doing, and establish guardrails to ensure they achieve the intended outcomes," said Nick Schneider, CEO of Arctic Wolf, he said, adding that the biggest challenge for enterprises is balancing innovation with security. "Organisations deploy too quickly, haven't put any guardrails up and AI starts operating in a way that it shouldn't," he said, speaking at a panel moderated by ET's Himanshi Lohchab.

Puneet Chandok, president, Microsoft India and South Asia, said the industry's reliance on "human in the loop" is being misunderstood. "It was never supposed to be humans on every keystroke," he said. "We don't need a fast human, we need proper boundary conditions."


Cybersecurity budgets must also evolve alongside AI investments, according to Chandok. "Security is still being viewed as a percentage of the IT budget. AI ambition is growing three times faster while security spending remains flat," he said. "Security has to become a percentage of your AI ambition and it has to be built by design, not bolted on afterwards."

For CERT-In, India's national cyber defence agency, AI has fundamentally altered the threat landscape.

"We are now in an era of agents versus agents," said Sanjay Bahl, director general, CERT-In. "Attackers and defenders are both using AI agents that can plan, use tools, write code and carry out multi-stage coordinated attacks." He warned that AI agents now possess digital identities that could become targets themselves. Bahl also cautioned that AI will make phishing attacks and deepfakes significantly harder to detect. But that responsibility should not rest solely with users. Nothing cofounder and India president Akis Evangelidis said smartphones have effectively become users' digital identities, making them one of the most critical points in the cyber ecosystem. "Your smartphone is basically your digital identity, from your photos to your passwords," he said.

As AI moves to the edge, Evangelidis said companies must ensure robust guardrails around AI agents, particularly by limiting system-level access and building security into devices by design.

From an AI research perspective, Ganesh Ramakrishnan, founding director of BharatGen, said many instances of so-called rogue AI behaviour stem from the way models are designed and rewarded rather than from malicious intent.

"The rogue behaviour is not necessarily rogue by design. It's because the end has been prioritised over the means," he said.

AI systems, according to Ramakrishnan, should be treated as "glass boxes" rather than black boxes, allowing developers to understand how models reach decisions instead of focusing only on outcomes. "The 'what' and the 'how' need to coexist," he said.