India tightens cyber defenses with indigenous AI, new rules

By mid-2026, MeitY Secretary S. Krishnan had framed cybersecurity threats to India's critical infrastructure as tantamount to warfare, emphasizing the urgent need for resilient AI-ready software and hardware systems. He highlighted AI's dual role as both a source of emerging cyber risks and a powerful tool for defense, underscoring the imperative to develop robust domestic AI and cybersecurity capabilities to safeguard national interests.

Recognizing that operational resilience in cybersecurity directly impacts India's 'ease of living' and 'ease of doing business,' government leaders linked secure digital infrastructure to the nation's broader socio-economic progress amid rapid digital adoption. This perspective positioned cybersecurity not just as a technical challenge but as foundational to the country's digital governance framework, particularly with the increasing integration of AI technologies.

To effectively counter sophisticated cyber threats, the Indian government instituted a coordinated multi-agency response, with MeitY and CERT-In centrally managing cybersecurity preparedness and incident response, while the Ministry of Home Affairs focused on cybercrime affecting citizens. This collaborative framework reflects a strategic approach to protecting government infrastructure and national digital assets through unified efforts.

Strategically, India has emphasized building indigenous capabilities in AI, cybersecurity, and digital infrastructure to reduce reliance on external technologies and enhance national cyber resilience. This shift towards self-reliance aims to equip defenders with advanced AI-driven tools for threat detection, real-time analysis, automated response, and predictive security, thereby proactively countering evolving cyber adversaries.

The Kudankulam cyber incident starkly revealed how India's critical infrastructure is vulnerable not just through direct attacks but via the interconnected digital supply chain, particularly third-party contractors. While the nuclear plant's operational technology and safety systems remained intact, attackers exploited the IT environment of a trusted vendor, exposing sensitive engineering drawings, procurement data, and inspection reports that collectively form a detailed intelligence blueprint. This breach underscores the growing trend in modern cyber warfare where sophisticated threat actors target trusted suppliers to infiltrate strategic assets, mirroring high-profile global incidents like SolarWinds and Kaseya.

As digitalisation accelerates in India's energy sector, the convergence of IT and operational technology (OT) environments has expanded the attack surface, linking legacy grid assets with modern technologies and thereby increasing vulnerability to cyber intrusions. GlobalData’s Ravindra Puranik highlights that vendor weaknesses, especially through shared software such as file-transfer tools, have become critical vectors for attacks that can cascade across both IT and OT systems. To counter these risks, energy companies must adopt rigorous vendor governance practices including continuous monitoring, network segmentation, least-privilege access controls, and coordinated incident response plans.

Despite the growing cyber threats, physical hazards currently pose a more immediate risk to India's power grid, with damage from animals like squirrels and even unconventional threats such as Mylar balloons causing more outages than cyberattacks. Sector-specific protective standards like SIP mandate ballistic protection for transformers to mitigate risks from physical attacks, reflecting the unique challenges in securing distributed operational technology. While the vast and diffuse nature of the grid complicates comprehensive physical security, this distribution paradoxically limits the potential impact of any single attack, as it is physically impossible for adversaries to target every asset simultaneously.

Adding a new layer of complexity, generative artificial intelligence is accelerating the speed and sophistication of cyberattacks, placing unprecedented pressure on energy companies' cybersecurity response capabilities. This evolving threat landscape demands not only robust technical defenses but also adaptive strategies that can keep pace with AI-enhanced adversaries, further emphasizing the critical need for continuous evaluation and enforcement of Zero Trust principles across all facets of critical infrastructure security.

In August 2026, the Ministry of Electronics and Information Technology (MeitY) issued a directive for India's cyber forensic labs to transition towards indigenous cybersecurity tools developed by C-DAC, startups, and other domestic entities. This initiative aligns with the Atmanirbhar Bharat vision, aiming to reduce foreign dependency by promoting homegrown innovation and fostering long-term self-reliance in cyber forensic capabilities. Dharshan Shanthamurthy, founder and CEO of SISA, hailed this move as a pivotal step in strengthening India’s cybersecurity infrastructure while encouraging domestic technological advancement.

MeitY emphasized that adopting indigenous cyber forensic tools offers multiple strategic advantages, including enhanced data sovereignty, cost-effectiveness, and the flexibility to customize solutions according to evolving investigative needs. By eliminating recurring licensing fees and dependence on external vendors, India can achieve greater operational autonomy and financial efficiency in its cybersecurity efforts. This shift not only safeguards sensitive data within national borders but also empowers forensic labs to rapidly adapt tools without the constraints typically imposed by imported software.

By early 2026, the Central Electricity Authority (CEA) formalized a landmark shift in India's power sector cybersecurity by introducing mandatory regulations effective April 1, 2027, under the Electricity Act of 2003. These rules replace prior voluntary guidelines and establish a statutory framework that requires rigorous cyber audits, incident reporting within strict timeframes to CSIRT-Power and CERT-In, and mandates the segregation of Operational Technology (OT) and Information Technology (IT) systems with encrypted data storage confined within Indian borders. CSIRT-Power, operational since April 2023, plays a pivotal role as the nodal agency coordinating these cybersecurity efforts, underscoring a centralized and enforceable approach to safeguarding critical infrastructure.

Parallel to the CEA's sweeping regulations, the Ministry of New and Renewable Energy (MNRE) imposed stringent cybersecurity compliance mandates on wind turbine original equipment manufacturers (OEMs) listed under the Approved List of Models and Manufacturers (ALMM), requiring submission of compliance status by August 31, 2026. This move compels engineering, procurement, and construction (EPC) contractors and developers to rigorously vet their supply chain partners' digital security postures to avoid project disqualification or regulatory roadblocks, reflecting the sector’s heightened focus on securing the renewable energy supply chain as India rapidly scales its clean energy capacity.

The 2026 CEA regulations mark a watershed moment by extending cybersecurity accountability beyond traditional power generation, transmission, and distribution entities to encompass a broad ecosystem of stakeholders including OEMs, system integrators, technology vendors, managed service providers, and cloud providers. This shared responsibility model acknowledges the complex, interconnected nature of modern power infrastructure, where vulnerabilities in any supply chain link could jeopardize the entire grid’s resilience. Emphasizing operational technology security, supply chain integrity, and data sovereignty, the regulations address the expanded cyber risk landscape driven by rapid digitalization, integration of renewables, and smart grid deployments.

By 2030, the Central Electricity Authority (CEA) is spearheading a transformative push to achieve full indigenous SCADA system independence for India's power grid, aiming to bolster national cybersecurity and energy security. This ambitious roadmap targets the localization of 38 software modules and 25 hardware components between 2026 and 2029, a critical leap from the current domestic content level of under 20%.

Hardware localization emerges as the most formidable hurdle in this transition, representing approximately 75% of the total SCADA system costs due to its complexity and capital intensity. To overcome these challenges, the government is actively exploring financial support mechanisms, including leveraging the Power System Development Fund (PSDF) to provide essential grants, underscoring the necessity of substantial R&D investment to meet the aggressive 2030 deadline.

This strategic initiative not only aims to secure technological sovereignty but also signals a lucrative long-term market opportunity for Indian firms specializing in automation, cybersecurity, and power electronics. However, the success of this endeavor hinges on the ability of domestic manufacturers to adhere to stringent performance and security standards within a tight timeline, making the effectiveness of government funding and industry collaboration pivotal to realizing the vision of total technological independence.

The Central Electricity Authority's Cyber Security in Power Sector Regulations, 2026, represent a pivotal evolution in India's approach to securing its critical power infrastructure by moving beyond traditional compliance mandates to establish a robust, enforceable framework emphasizing operational resilience. This regulatory shift acknowledges cybersecurity as a foundational element of operational reliability, business continuity, and national security, underscoring the sector's commitment to a trusted digital energy ecosystem.

Recognizing the complexity of the modern power sector's cyber risk landscape, the 2026 regulations expand accountability beyond utilities to encompass OEMs, system integrators, technology vendors, managed service providers, cloud providers, and other supply chain participants, thereby fostering a culture of shared responsibility. This inclusive approach is critical amid rapid digitalization and the integration of smart grid technologies and renewable energy sources, which collectively demand harmonized standards and collaborative governance to ensure a resilient and sustainable energy future.