Cyber Threat Landscape — Security Framework

Security Framework

Separate four questions: what can cause harm, what weakness could be exposed, what asset matters, and what consequence would follow? The same weakness can have different significance in a public information page and an emergency service because the consequences differ.

Phishing relies on deceptive communication that induces an unsafe action or disclosure. Ransomware concerns coercive disruption involving data or systems. A supplier-related incident can propagate through organisational dependencies. These categories can overlap, but their labels do not establish the identity of the actor or the scale of harm without evidence.

The 23 January 2026 official CERT-In backgrounder reported more than 29.44 lakh incidents handled in 2025. This is an administrative incident count. It is not automatically a count of unique victims, registered criminal cases or successful intrusions. Reporting practices and detection can influence the observed series.

India's framework includes CERT-In's incident-response role under section 70B and NCIIPC's critical-information-infrastructure role under section 70A. Criticality concerns the debilitating impact that disruption could have, not simply the popularity of a website.

The 2024 NIST CSF 2.0 links governance, identification, protection, detection, response and recovery. Its central lesson is to manage risk throughout the service lifecycle. Prevention matters, but organisations also need to detect problems, limit consequences and restore essential functions when preventive measures fail.