CERT-In exposes the real patching gap
A compelling story by Gyana Swain (
@mrgyan) in
@CSOonline on how
@IndianCERT is pushing aggressive remediation windows, continuous exposure management, and AI governance controls for Indian enterprises. The link to the story is attached, but for deeper analysis on this topic, head over to
greyhoundresearch.com.
Below is a snapshot of what we at Greyhound Research had to say on the topic.
At
@Greyhound_R, we believe the 12-hour clock is not the story. The real shift is India’s move from periodic vulnerability management to continuous exposure management.
CERT-In’s blueprint is more sophisticated than the headline suggests. It does not demand 12-hour patching across the enterprise. It reserves that expectation for containment on internet-facing and crown-jewel systems where exploitability is already visible, then extends the timeline based on exposure and criticality.
This distinction matters. Most Indian enterprises still run weekly or monthly patch cycles, but the first bottleneck is rarely patch deployment. It is visibility. Teams lose critical hours establishing whether an affected asset exists, who owns it, what it connects to, and whether isolating it will break something else.
Temporary mitigations make the timelines workable, but they also remove every excuse. Isolation, access restrictions, WAF and API protection, enhanced monitoring, and documented compensating controls only work when asset ownership, segmentation, and escalation paths are already clear.
The pressure will be sharpest in critical internal environments, especially finance, telecom, healthcare, and OT-heavy estates where change boards, uptime obligations, outsourced operations, and legacy dependencies slow response. The same problem extends to vendor-managed systems: when a third-party patch is delayed, the enterprise still owns the exposure window.
India’s model is also globally significant. Unlike
@CISAgov's KEV approach of vulnerability-specific due dates, CERT-In has introduced standing clocks by asset category. That may look aggressive today, but it previews where global standards are heading as AI compresses attacker timelines.
At this scale, advantage comes from exposure intelligence, not patch theatre. The organisations that win will be the ones with connected security, infrastructure, procurement, and vendor clocks.
csoonline.com/article/417824…
#GreyhoundStandpoint #Cybersecurity #CERTIn #ExposureManagement #VulnerabilityManagement #AI #CISO