Prevention CERT-Inly better than cure

India has responded adequately to last week's eMudhra digital certificate lapse and global PHP vulnerabilities through government advisories, industry audits and a high- level official probe. CERT-In flagged both incidents. MeitY confirmed that eMudhra's domestic digital signature certificates were unaffected. The ministry has ordered a probe into the eMudhra key generation failure. Banks and gov departments audited their systems for vulnerabilities and took action to prevent breaches. Critical vulnerabilities in PHP, a programming language used on the internet, are being addressed.

India faces a high degree of cybersecurity risk because of the scale of its digital transformation, legacy framework gaps and the emergence of AI-driven attack vectors. A large part of the country's digital infra is built with open-source software. The foundations of secure online commerce are also not free of risk, as the eMudhra episode shows. Tests have shown that misconfigurations in third-party connections for the India Stack, including Aadhaar, allow authentication checks to be bypassed. AI can now exploit infrastructure weaknesses at high speed, rendering rapid responses less effective in countering a security attack.

India must move away from its reactive model of cybersecurity towards building threat detection-capabilities. CERT-In must get ahead of the curve. There are concerns that budgeted funds for improving cybersecurity remain unutilised and that the country faces a talent shortage. A holistic transformation of cybersecurity requires modern regulations, upgraded defences and a larger workforce. Software must be built securely by design, and risk-based controls should be in place for critical sectors like energy, health, transport and telecom. The emphasis must shift away from GoI acting alone towards better coordination with states and multilateral agencies. Adequate response is one dimension of cybersecurity. India needs to improve its handling of other dimensions too.