- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
A CFO at a mid-sized Indian manufacturing firm receives a WhatsApp video call from what appears to be the company’s Managing Director. The voice, the face, the mannerisms — all familiar. The request: an urgent wire transfer to close a cross-border deal before the window closes. The CFO complies. The “MD” was a deepfake. The money is gone.
This is not a hypothetical. Deepfake-enabled Business Email Compromise (BEC) and voice/video fraud have moved from proof-of-concept to operational threat. In 2025 and into 2026, AI-generated phishing kits and real-time voice-cloning APIs have become commodity tools on the dark web, accessible for as little as $20 per month. Indian enterprises — with large treasury operations, complex supply chains, and rapid digital adoption — are prime targets.
This post unpacks how these attacks work, why traditional defences fall short, and what your security operations team must do differently.
Classic phishing relied on volume and luck. A poorly worded email with a suspicious domain might fool one in a thousand recipients. Modern AI-assisted phishing is the opposite: surgical, personalised, and contextually aware.
Attackers now feed publicly available information — LinkedIn profiles, press releases, annual reports, regulatory filings — into large language models to generate hyper-personalised lure emails. The output can mimic the tone and vocabulary of a known sender with alarming accuracy. Grammar errors, the traditional indicator of a phishing attempt, are largely absent.
Three to five seconds of audio — scraped from a public earnings call, a conference presentation, or even a social media video — is sufficient for modern voice-cloning APIs to produce a convincing replica. Threat actors use these to impersonate CEOs, CFOs, and IT administrators in real-time phone calls or pre-recorded WhatsApp voice notes.
Deepfake video attacks, while more resource-intensive, are no longer restricted to nation-state actors. Commodity tools can produce a realistic video call overlay running on a standard laptop. The CFO scenario above is not speculative — variants of it have been reported in Hong Kong, Singapore, and increasingly in Indian financial services and manufacturing.
Most Indian enterprises deployed their email security stack in the 2015–2020 window. The threat model those tools were built for — bulk spam, known-bad URLs, static malware signatures — bears little resemblance to today’s AI-assisted attacks.
The gap between what attackers can now generate and what legacy tools can detect is widening every quarter.
India’s DPDP Act and CERT-In’s 2022 cybersecurity directions add a compliance layer to the operational risk. Under CERT-In’s directive, organisations must report cyber incidents — including phishing attacks that result in data compromise — within six hours of detection. That is an extremely tight window, particularly for enterprises that lack automated detection and response pipelines.
Additionally, CERT-In mandates that logs be retained in India for 180 days. Many organisations discover during an incident investigation that their email gateway logs are incomplete, stored offshore, or purged after 30–60 days — creating both a compliance gap and an evidential blind spot.
Key compliance exposure: A successful AI-phishing attack that exfiltrates customer PII triggers simultaneous DPDP Act (data breach notification to DPBI) and CERT-In (6-hour incident report) obligations. Organisations with slow detection pipelines will breach both.
Defending against AI-powered social engineering requires defence-in-depth across email, endpoint, network, and human layers. Here is a practical framework for Indian enterprise security teams.
When an AI-powered phishing attack lands in your environment, the first question your SOC faces is: how far did it go? An email was opened — was a payload delivered? Was a credential stolen? Did the attacker move laterally? Answering those questions fast enough to meet CERT-In’s 6-hour window requires correlated visibility across email, endpoint, network, and identity logs — and that is precisely the gap that platform-level SecOps tooling is designed to close.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner, and we deploy and operate it for clients across manufacturing, financial services, healthcare, and retail in India.
The platform’s four pillars each address a distinct blind spot in the phishing attack chain:
SIEM — Attack Storyline Reconstruction: Ora’s SIEM ingests logs from email gateways, firewalls, endpoints, identity providers, and cloud workloads into a unified correlation engine. Rules are mapped to MITRE ATT&CK, so a phishing email that delivers a credential-stealing payload surfaces as a chained alert — Initial Access → Credential Access — rather than three isolated, easy-to-miss events. Critically, tiered log retention (hot/cold/archive) with in-country storage supports CERT-In’s 180-day log retention direction, which many organisations are currently non-compliant on.
NMS — Anomalous Traffic Detection: The Network Management System provides unified observability across FortiGate firewalls, switches, access points, and WAN/SD-WAN links. ML-based anomaly detection flags unusual outbound traffic patterns — for example, a workstation suddenly beaconing to a newly registered domain after a user opened an attachment. In multi-vendor estates where NOC visibility is otherwise fragmented across three separate dashboards, this unified view dramatically shortens time-to-detection.
Video Surveillance (VMS) — Physical Context: For manufacturing and retail clients with multi-site estates, Ora’s video surveillance (VMS) module — supporting ONVIF, Hikvision, and Dahua cameras with video analytics — brings physical security events into the same operational view as network security events. A tailgating attempt at a server room coinciding with a phishing alert is a correlation your security team needs to see in one place.
SOAR — Making 6-Hour Reporting Realistic: The CERT-In 6-hour incident reporting window is one of the most operationally challenging compliance requirements in India. Ora’s SOAR module automates initial response playbooks: when a phishing campaign is confirmed, pre-built connectors automatically push blocklists to FortiGate firewalls, isolate affected endpoints, and generate a draft CERT-In incident report populated with the available evidence. Automation is not a luxury here — it is what makes the timeline realistic for a 24/7 SOC under incident pressure.
If your organisation is evaluating SecOps platform consolidation or needs to accelerate CERT-In compliance readiness, we are glad to walk you through a deployment reference architecture.
Technical controls are necessary but not sufficient. Your employees are both the primary attack surface and your first line of detection. Train all staff — not just IT — to recognise these indicators:
Every enterprise should have a documented phishing response playbook. Here is a starter checklist aligned to the CERT-In timeline:
PJ Networks provides 24/7 managed SOC and NOC services to Indian enterprises, with a security stack built around FortiGate NGFW, FortiMail, ZTNA, and the PrahiX Ora SecOps platform. We help organisations:
AI-powered phishing is not a future threat — it is active in Indian enterprise environments today. The organisations that respond fastest will be the ones with the right technology, tested processes, and a capable SOC behind them.
Reach out to PJ Networks to assess your current phishing defence posture and understand what it would take to meet CERT-In’s six-hour reporting requirement under a real incident scenario.