AI and Security Automation: A Practical Guide for Indian Businesses
0101 Labs ·
Security teams in Indian companies face more alerts than people to read them, attackers who now use AI themselves, and a regulator that expects incidents to be reported within hours. AI and security automation is how many organisations are trying to keep up: software that spots suspicious activity, sorts real threats from noise and carries out the first response steps without waiting for a human.
This article explains where AI genuinely helps in cybersecurity, where it introduces new risks, what Indian rules such as the CERT-In directions require, and how a mid-sized company can start without building a large security operations centre.
What "AI and security automation" means
The phrase covers two related ideas that work best together:
- AI for detection and decisions: machine learning models that learn what normal looks like in your network, endpoints, email and user accounts, then flag what does not fit. Generative AI is increasingly used to summarise alerts, explain them in plain language and draft investigation notes.
- Automation for response: rules and playbooks that act on those findings, such as isolating a laptop, disabling a compromised account, blocking a domain or opening a ticket with the right evidence attached.
The business case is now measured. IBM's Cost of a Data Breach Report 2026 found that the average cost of a breach in India reached an all-time high of ₹25.5 crore. Organisations with no AI or security automation paid an average of ₹31.6 crore per breach, compared with ₹21.3 crore for those making extensive use of it.
Five places AI is used in security automation
1. Threat detection and anomaly spotting
Signature-based tools catch known malware. AI models add behavioural detection: a server suddenly sending large volumes of data abroad at 3 a.m., a service account logging in from a new country, or a process encrypting files at speed. These patterns are hard to write as fixed rules but stand out against a learned baseline.
2. SOC alert triage
A security operations centre (SOC), in-house or outsourced, can receive thousands of alerts a day from firewalls, endpoint tools, cloud consoles and email gateways. AI helps by grouping related alerts into a single incident, scoring them by likely severity, enriching them with context (who owns the asset, is it internet-facing, has this user done this before) and suppressing known false positives. Analysts then spend their time on the small number that matter.
3. SOAR playbooks
Security orchestration, automation and response (SOAR) platforms run playbooks: step-by-step workflows triggered by an alert. A phishing playbook, for example, might pull the reported email, check links and attachments in a sandbox, search every mailbox for the same message, remove it, block the sender and notify the affected users. Steps that once took an analyst an hour can run in minutes, with a human approving the high-impact actions.
4. Phishing and business email compromise detection
Phishing remains the most common way in. IBM's 2026 India findings list phishing, including voice and SMS phishing, as the most common initial attack vector at 19%. AI models examine sender behaviour, writing style, lookalike domains and unusual payment requests, which helps catch invoice fraud and CEO impersonation that contain no malicious link at all.
5. Identity and access anomalies
Most attacks eventually use a valid login. User and entity behaviour analytics (UEBA) learns how each person and system normally behaves, then flags impossible travel, sudden access to sensitive folders, privilege escalation or mass downloads before resignation. Combined with automation, the response can be a forced re-authentication or a temporary block rather than a silent log entry.
The benefits, and the limits
Area | What AI and automation improve | What still needs people |
|---|---|---|
Detection | Finds unusual behaviour that fixed rules miss | Tuning baselines, judging business context |
Triage | Groups, scores and enriches alerts, reducing noise | Final call on ambiguous incidents |
Response | Runs repeatable containment steps in minutes | Approving disruptive actions, such as shutting a production server |
Reporting | Collects evidence and timelines automatically | Regulatory judgement and customer communication |
Coverage | Monitors around the clock without fatigue | Threat hunting, architecture and policy decisions |
The limits are real. Models trained on your environment can drift as systems change. Poorly tuned automation can lock out legitimate users or take down a business process. And no tool fixes missing basics such as patching, multi-factor authentication and backups.
The other side: AI-powered attacks
Attackers have the same tools. IBM's 2026 India release notes that 26% of malicious breaches in India were AI-generated, and that AI is helping attacks become faster, more sophisticated and more scalable. In practice this means:
- Phishing emails in fluent English and Indian languages, personalised from public social media profiles.
- Voice cloning used in calls that impersonate a senior executive asking for an urgent transfer.
- Faster discovery of exposed systems and known vulnerabilities.
- Malware that changes its appearance to slip past signature checks.
There is also an internal risk. Employees pasting customer data or source code into public AI tools create "shadow AI" exposure. IBM's 2026 India findings put the added cost of shadow AI at an average of ₹1.79 crore where it was present. Any security automation programme should include an AI usage policy and controls over which tools staff can use.
The Indian regulatory context
CERT-In's six-hour reporting rule
The CERT-In directions dated 28 April 2022, issued under Section 70B(6) of the IT Act, require service providers, intermediaries, data centres, body corporates and government organisations to report specified cyber incidents to CERT-In within 6 hours of noticing them or being told about them. The same directions require organisations to:
- Synchronise ICT system clocks with NTP servers of NIC or NPL, or servers traceable to them.
- Enable logs of all ICT systems and keep them securely for a rolling 180 days within Indian jurisdiction.
- Designate a point of contact to interface with CERT-In.
Six hours is very little time to detect, confirm and describe an incident manually. Automation helps directly: centralised logging meets the retention requirement, consistent timestamps make timelines reliable, and playbooks can assemble the facts needed for a report while analysts focus on containment.
Sector and data protection rules
Regulated entities face additional expectations. Banks and NBFCs follow RBI cyber security frameworks, insurers follow IRDAI guidelines, and listed companies and market intermediaries follow SEBI's framework. The DPDP Act, 2023 adds obligations to protect personal data and to notify the Data Protection Board and affected individuals of breaches. If you operate in financial services, see our work on AI in BFSI.
How a mid-sized company can start
You do not need a 24x7 in-house SOC to benefit. A practical sequence looks like this:
- Get the basics right: multi-factor authentication everywhere, patching discipline, tested backups and an asset inventory. Automation amplifies good hygiene; it does not replace it.
- Centralise logs: bring firewall, endpoint, email, cloud and identity logs into one place with 180-day retention and synced clocks. This also covers key CERT-In requirements.
- Use the AI you already pay for: many Microsoft 365, Google Workspace and endpoint licences include behavioural detection and automated response features that are switched off or untuned.
- Automate two or three playbooks first: reported phishing, compromised accounts and malware on an endpoint are common starting points. Keep a human approval step for disruptive actions.
- Write the incident runbook: who decides, who reports to CERT-In, who talks to customers. Rehearse it.
- Measure: track mean time to detect, mean time to respond, false positive rate and analyst hours saved, and review quarterly.
- Decide build versus buy: a managed detection and response provider may suit you better than an in-house team; automation and AI should still sit around your own systems and data.
Avoid the common trap of buying a large platform before you know which problems it should solve. We explain the pattern in why AI implementations fail to deliver ROI.
How 0101 Labs approaches AI in security operations
0101 Labs builds custom AI solutions and automation for businesses from our base in Andheri East, Mumbai. We are not a replacement for your security vendor or managed SOC. Our role is to help with the AI and automation layer around them: alert summarisation and triage assistants, workflow automation that connects your security tools to ticketing and communication, and reporting that pulls evidence together quickly.
Our technology AI expert starts with a measurable problem, such as hours lost to false positives or slow phishing response, agrees how success will be measured, and builds around the tools you already run. Learn more about our AI technology solutions and custom AI solutions.
Conclusion
AI and security automation are now part of how Indian organisations keep breach costs down and meet tight reporting deadlines. The gains come from better detection, faster triage and repeatable response, while the risks come from attackers using the same technology and from staff using AI tools carelessly. Start with solid basics and centralised logs, automate a few high-volume playbooks with human oversight, and measure the results before expanding.
Frequently Asked Questions
Can AI replace a security team?+
No. AI reduces alert noise and speeds up routine response, but people are still needed to judge business context, approve disruptive actions, hunt for threats and handle regulators and customers.
What is the difference between SIEM and SOAR?+
A SIEM collects and correlates logs to detect suspicious activity. A SOAR platform takes the resulting alerts and runs automated playbooks to investigate and respond.
Does the CERT-In six-hour rule apply to small companies?+
The 2022 directions apply to service providers, intermediaries, data centres, body corporates and government organisations, which covers most registered companies. Check the reportable incident list and FAQs on the CERT-In website with your legal adviser.
Is it safe to use generative AI tools for security investigations?+
It can be, if the tool is approved, data stays within agreed boundaries and outputs are checked by an analyst. Avoid pasting logs or customer data into public AI tools without controls.
What should we automate first in security?+
High-volume, low-ambiguity tasks are the best starting point, such as handling reported phishing emails, resetting compromised accounts and isolating infected endpoints, with a human approval step for high-impact actions.
