India is the seventh most targeted country in the world for cybersecurity threats and the third most targeted in Asia, Nicholas Butts, Microsoft’s director of AI and cybersecurity policy, said at the NDTV World Summit 2026 in New Delhi on Friday (23 October). “The threat is very real to India,” he said. The scale of India cyber threats, he argued, is a present-tense problem, not a distant one.
How serious are India cyber threats
Butts put numbers on the India cyber threats problem. Microsoft processes about 165 trillion telemetry signals every day, screens about 5 billion emails daily and blocks about 5 million net-new malware files every day. The 165 trillion daily signals come from Microsoft’s products running on devices and networks around the world, which is how the company builds its picture of who is being targeted. The figures describe the sensor network Microsoft uses to watch threats: signals from devices, emails screened for phishing and malware, and new malicious files blocked before they run. “What we’re seeing is not about potential doom and gloom in 10 years but about very real security threats right here today,” he said, using what he called a “leaky roof” analogy: the damage is happening now, not in some imagined future.
The analogy was aimed at anyone treating cyberattacks as a future risk. A leaking roof damages the house now, and Butts’s point was that the threats facing the country are doing damage now, not in ten years.
Three examples followed. The first was “Storm 3168”, sometimes called Jadepuffer, a ransomware organisation based in China that uses AI agents to run ransomware attacks against customers worldwide. Ransomware outfits encrypt a victim’s data and demand payment for its release, and AI agents let groups like Storm 3168 run those operations at greater scale. The group shows how AI feeds directly into India cyber threats and into attacks everywhere else, wired into criminal operations rather than sitting on the sidelines.
Espionage campaigns add to India cyber threats
The second example was espionage. Butts said Russian and Chinese state-sponsored actors are using AI agents in espionage campaigns, one more layer of India cyber threats for defenders to track. Microsoft published a new threat intelligence report on 22 October about an actor it tracks as “Storm 0940”, a Chinese state-sponsored linked actor focused on data theft and espionage. The report landed a day before Butts spoke, giving his espionage example a fresh case to point to.
The third example was “EvilTokens”, first tracked in February. It was built by just two individuals who “vibe-coded” a fully autonomous criminal infrastructure using open-source and closed-source models. The EvilTokens case stood out because of its size relative to its builders: two people produced a criminal infrastructure that touched more than 10,000 organisations in 120 countries. A $1,500 entry price and a $500 monthly subscription put the operation’s tooling within reach of buyers who could never have built it themselves. The operation sold access for $1,500, with a $500 monthly subscription for first-time buyers, and operations like it are part of India cyber threats too.
AI lowers the bar behind India cyber threats
That was Butts’s larger point: AI is lowering the barriers to entry. Less sophisticated cybercriminals, the kind who add daily to India cyber threats, can now launch attacks that are more effective and more scalable than anything they could manage before. More effective and more scalable attacks from less skilled criminals means defenders face more incidents, not just more sophisticated ones. Tools that once required a skilled team can now be assembled by two people with the right models. The barriers Butts described are still falling, which is why he framed the threat as immediate rather than theoretical.
For India, ranked seventh in the world and third in Asia for targeting, the picture of India cyber threats that Butts painted was blunt. Seventh in the world puts the country behind only a handful of nations in the volume of attacks Microsoft observes. “The threat is very real to India,” he said, and the roof is already leaking.