Cyber attacks have gotten cheaper. Not long ago, a convincing phishing email or a cloned voice took real skill and a fair amount of patience. These days a tool drafts it in seconds. Defenders have the same tools, of course, but they also have ageing systems, tight budgets and a business that cannot be switched off while repairs are made.
The bill is already visible. According to IBM’s Cost of a Data Breach Report 2026, a breach in India now costs an organisation ₹25.5 crore on average, a record for 2026. Finance heads notice figures like that, not just security teams.
The old warning signs are gone
For years we told staff to look for bad spelling and odd phrasing. That advice is ageing fast. Generative tools write clean English and Hindi, and they can tailor a message to someone’s job and the project they are working on this week. Voice and video cloning add another layer, because a call from “the CEO” no longer proves anything. Attackers also need less skill than before. Research, scripting and basic testing of exploits can be automated, so more people can have a go.
Most breaches still start somewhere boring
The instinct is to buy an AI product to fight AI. I would resist it for a while. Read a few breach post-mortems and the way in barely changes. A stolen password. A server that missed a patch. An account that could reach far more than its owner ever needed. Fixing those is cheaper than any new platform. Use multi-factor authentication that phishing cannot trick, patch to a timetable, tighten access rights and split the network into zones. Backups need a real test too. Until someone has restored from one, you only have hope. No detection tool, however clever, will cover for gaps like these.
Where AI helps defenders, and where it needs watching
AI does help on defence. Picture an analyst facing thousands of alerts in a day, nearly all of them harmless. A decent model clears much of that clutter, groups related events and raises the odd one that looks wrong. Don’t expect it to work out of the box, though. Someone who knows your environment has to tune it. Start small. Give it one job, such as alert triage, and for the first few weeks count what it gets wrong, false alarms and misses alike. Someone senior should own every decision it feeds. Then ask the supplier the awkward things. Where did the training data come from? Can it explain a decision? What happens when it fails? A tool nobody can explain is simply another risk on the register.
Watch what your own people do with AI
Some exposure is self-inflicted. Staff paste contracts, customer lists and source code into public chatbots to save an hour, and most organisations couldn’t tell you how often. Rules alone rarely hold, since people drift away from anything that slows them. The better fix is to make the approved route the easy one. That means a decent tool, access limits that make sense, logs, and data marked clearly enough that nobody has to guess. Anything built in-house needs its own review: how does it cope with input it cannot trust, and what can it reach?
Make checking routine
Tools will miss some fakes, so the process has to catch what they don’t. Confirm any large payment, and any change to a supplier’s bank details, through a second channel, such as a call to a number already on file. Make no exception for a message that appears to come from the chief executive. Better still, have leaders say openly that they want to be checked.
What boards should ask
Boards cope well with plain questions. How fast would we spot an intruder? How fast could we stop one? Then the one people dislike: when did we last restore from a backup, and did it actually work? A drill teaches more than a slide deck. Try a deepfake instruction landing in the finance team, and play out the uncomfortable bits too, such as who calls customers and who tells the regulator. Give teams time with the new tools as well. Left alone, they tend to trust them more than they should.
No finish line
The race does not end. Attackers will keep improving, and each year brings another product promising to settle the matter. The firms that do best tend to be the ones that fixed the basics early, watched their own use of AI, made checking a habit and recovered fast when a defence gave way.
Authored by Abhishek Agarwal, President, Judge India & Global Delivery, The Judge Group
