The next cyberattack may not wait for a security analyst to finish investigating the previous one. Artificial intelligence is compressing the time attackers need to identify vulnerabilities, automate reconnaissance and generate convincing phishing campaigns. Meanwhile, enterprises are deploying AI agents, connecting models to internal data and embedding AI into business-critical workflows, expanding the attack surface from both outside and within.
For CISOs, this creates a fundamental challenge: conventional security operations, built around manual investigations and reactive controls, may struggle to keep pace with attacks that evolve in minutes.
“The shift towards AI-versus-AI cyber warfare is no longer theoretical, it’s already underway,” says Vaibhav Koul, Managing Director, Protiviti Member Firm for India.
Indian enterprises are already encountering AI-assisted phishing, deepfake-enabled business email compromise and automated reconnaissance, Koul says. But the threat extends beyond malicious actors using AI. Employees, enterprise AI agents and interconnected workflows can introduce risks when organisations lack adequate controls over how AI is accessed and used.
Protiviti’s insider risk research with Microsoft found that 84% of organisations in India feel unprepared to manage risky AI usage. For Koul, this exposes a critical gap in generative AI governance, cloud uploads and behavioural monitoring.
“The next battleground is not only defending against AI-powered attackers but also securing AI-enabled employees, agents, and enterprise workflows,” he says.
The implications reach well beyond cybersecurity teams. As AI becomes integral to business operations, organisations must rethink digital identity, operational resilience, governance and the relationship between security and business growth.
From detecting attacks to containing them autonomously
The traditional security operations centre (SOC) relies heavily on alerts, investigation workflows and analysts who correlate information across multiple systems. AI changes the economics of this process by enabling faster threat identification, investigation and response.
Koul describes the emerging model as an “Autonomous SOC 3.0”, in which AI augments analysts by correlating signals, validating threats and initiating containment at machine speed.
“The future SOC won’t just detect threats — it will decide at machine speed,” he says.
Routine activities such as alert triage, threat correlation, incident enrichment, endpoint isolation and containment of risky identities are likely to become increasingly autonomous. This could free security teams to focus on more complex threats and decisions that require business context.
However, autonomy does not eliminate the need for human judgement. “AI brings the speed; humans bring the judgement,” Koul adds.
Threat hunting, novel attacks, crisis management and decisions involving significant business risk will continue to require experienced security professionals. The workforce must consequently evolve from managing individual alerts towards orchestrating AI-assisted investigations, behavioural analytics, identity security and intelligent defence.
The objective is not simply to detect threats faster. It is to shorten the time between detection, containment and recovery.
Digital identity becomes the security perimeter
As enterprises introduce AI agents capable of accessing information and executing workflows, traditional identity controls need to account for more than employees and devices.
Every human, device, workload and AI agent requires continuously verified, risk-based access rather than relying solely on one-time authentication.
This becomes especially important when AI agents can interact with enterprise applications, retrieve sensitive information or initiate actions on behalf of employees.
The challenge is to establish who or what is acting, which resources it can access and whether that access remains appropriate as circumstances change. An organisation may have strong authentication for its employees but still expose itself to risk if AI agents operate with excessive permissions or without adequate monitoring.
For Koul, digital identity is becoming the primary security perimeter. This also connects cybersecurity with AI governance: organisations need clear ownership of AI systems, least-privilege access, auditable actions and controls that prevent autonomous systems from operating beyond their authorised boundaries.
The principle is straightforward, AI must be able to act at speed without becoming an unaccountable route into enterprise systems.
Cyber resilience must reach the boardroom
The shift towards AI-powered threats also changes how boards should evaluate cybersecurity.
Incident counts, compliance scores and the number of security tools deployed provide only a partial picture of an organisation’s ability to withstand an attack. The more consequential question is whether critical business services can continue operating when a core application, cloud provider or supplier becomes unavailable.
“A cyber-attack doesn’t just hit IT — it can eat into revenue, shake customer trust, mess with operations, create regulatory headaches, and threaten critical services,” Koul points out.
Boards should therefore examine recovery times, exposure across critical business processes, dependence on third parties and whether the organisation can maintain essential services during a disruption.
The distinction is between having a continuity plan and demonstrating that it works under realistic conditions.
Koul argues that cybersecurity should also be understood as an enabler of innovation rather than merely a cost centre. In Protiviti’s AI Pulse research, organisations with greater confidence in their data were three times more likely to exceed their AI return-on-investment expectations.
“Governance and strong controls open the door for faster innovation,” he says.
For enterprises investing in AI, this is an important business consideration. Poorly governed data and insecure systems can undermine adoption, while stronger controls can help organisations use AI with greater confidence.
Responsible AI cannot be a final compliance check
As AI moves from experimentation into business-critical processes, governance must be embedded throughout the lifecycle rather than introduced at the point of deployment. “Move fast but govern faster,” Koul asserts.
He advocates a federated AI governance model in which business teams own AI outcomes, while risk, legal, privacy, cybersecurity and compliance functions provide independent oversight.
Every AI system should have clear ownership, risk classification, human-oversight triggers and continuous monitoring for explainability, fairness, security and model drift. As AI agents become more autonomous, verified identities, least-privilege access and auditable actions become equally important.
For Indian enterprises, this approach must account for the Digital Personal Data Protection Act, sectoral expectations from regulators such as the Reserve Bank of India and the Securities and Exchange Board of India, and cybersecurity requirements. Koul also points to frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 as foundations for structuring AI risk management.
Yet the challenge extends beyond formal compliance. Privacy controls must work in actual business processes, from consent management and customer journeys to third-party data flows.
“The next phase of India’s privacy journey isn’t about writing more rules; it’s about making trust operational,” he says.
That requires clear accountability, privacy by design, verifiable consent and auditable governance. The aim is to turn regulatory expectations into repeatable operational controls rather than documentation that exists primarily for compliance reviews.
India’s opportunity is to build trust alongside scale
India enters this next phase with significant advantages, including its Digital Public Infrastructure, expanding cloud adoption, technology talent and growing global capability centre ecosystem.
Protiviti’s Vision AI research with the Confederation of Indian Industry covered AI adoption across more than eight industries. Koul says Indian organisations are already applying AI to areas such as fraud detection, predictive maintenance, customer experience and healthcare, although data quality, integration, compliance and talent readiness continue to constrain scaling.
The next step is to integrate security and resilience into this growth rather than treating them as downstream requirements.
Over the next five years, Koul believes India should prioritise secure-by-design infrastructure, stronger AI security, specialised cybersecurity talent, focused training academies and deeper partnerships between government, industry and academia. As digital ecosystems become more interconnected, resilience must also extend across sectors rather than remain confined to individual organisations.
His advice to CIOs and CISOs is to assess AI risk alongside AI adoption, not after transformation programmes have been completed.
“Leadership in AI won’t be defined just by how fast we scale but by how securely and responsibly we scale,” Koul says.
That is ultimately the test facing enterprise cybersecurity. In an environment where AI can accelerate both attacks and defence, detection alone is no longer sufficient. Organisations must build the identity controls, governance mechanisms and recovery capabilities to contain threats quickly and sustain business operations.
India’s ambition to become a global AI hub will depend not only on its ability to deploy the technology but also on its ability to make that deployment trustworthy.