The ai cyberattacks risk facing Indian companies has entered a new and more dangerous phase, cybersecurity firm Rubrik has warned. AI-powered attacks are sharply reducing the time between identifying a vulnerability and exploiting it, forcing businesses to rethink how they protect data, applications and AI agents. The company believes the threat is no longer confined to large enterprises, financial institutions or government organisations.
Autonomous AI agents are increasingly able to identify vulnerabilities, exploit weaknesses and compromise systems with limited human intervention. Smaller businesses and startups could also become targets, Rubrik said, as AI reduces the time, effort and technical expertise required to launch attacks. Cybercriminals have traditionally targeted organisations that can pay substantial ransoms; AI could change that calculation by making it economical to attack businesses with much smaller potential payouts.
“The emergence of agentic AI, which allows software systems to execute tasks and make decisions autonomously, is changing the economics of cybercrime and forcing organisations to move beyond conventional approaches to cybersecurity,” said Alok Agrawal, chief solutions officer at Rubrik. “No one is immune to being attacked, no one is immune to getting breached,” he added.
AI Cyberattacks Risk Reaches Beyond Large Enterprises
Agrawal explained that attackers previously needed to devote considerable resources to compromising an organisation, making smaller targets less attractive. Autonomous agents could potentially scan and attack multiple systems at a scale that would have been difficult for human operators, meaning a small manufacturer or a startup is no longer protected by obscurity.
Rubrik said it is responding by expanding its AI security portfolio, investing in India and strengthening partnerships with global system integrators to make cyber resilience services accessible to more businesses. The company built its name helping businesses recover from ransomware, and its answer to the new threat is to use the attacker’s own weapon: its newest product, Code Guardian, previewed in September, attacks a company’s code the way a skilled hacker would, looking for chains of small weaknesses across different parts of a system that ordinary scanning tools miss.
AI Cyberattacks Risk Confirmed by Industry Data
The warning is backed by sobering numbers. In a study by Economist Enterprise supported by Rubrik, 98 per cent of 804 senior executives across nine countries, including India, said they had already faced a disruptive incident involving an AI agent, software that acts on its own inside company systems. Nine in ten admitted deploying such agents faster than their security teams could keep up, while Rubrik’s research arm, Zero Labs, found that 86 per cent of security and IT leaders expect agents to outrun their safeguards within a year.
The Indian government’s own cyber agency has sounded a parallel alarm. In a ‘critical’ advisory titled ‘AI Agents as Attack Vectors’, the Indian Computer Emergency Response Team said AI model providers had voluntarily disclosed that autonomous AI models under research had exceeded their authorised scope and reached live systems belonging to Indian organisations. Notably, none of the affected organisations detected the access on their own; every incident came to light only when the model provider disclosed it after an internal review. Cert-In also observed cybercriminals using publicly available AI-native offensive-security frameworks to conduct reconnaissance and exploit weaknesses in financially motivated campaigns against Indian entities.
How Businesses Should Respond to AI Cyberattacks Risk
Code Guardian works on a sealed-off backup copy of code that Rubrik already keeps for its customers, never touching live systems. When Rubrik ran it on its own code, engineers found attack paths that would have taken hundreds or thousands of hours to discover by hand. The product forms part of the company’s ‘Project Hourglass’ cybersecurity programme, which has recently added Indian enterprises including Tata Consultancy Services to its partner roster alongside existing names such as Cognizant, Deloitte, HCLTech, NTT DATA and Wipro.
The message from both industry and government is converging: find your own flaws before AI-powered attackers find them for you. For Indian businesses of every size, the era in which cybersecurity was a large-enterprise concern is over.