Attackers have hired AI. Most brands have not.
AI has made attacks faster, cheaper and harder to spot. Retail brands sit right in the path: lots of shoppers, lots of logins, card payments and big sale days. And in India, the rules on reporting and protecting data now have clocks attached.
Attacks now run at machine speed.
The time between a first foothold and real damage has shrunk from days to minutes, and sometimes seconds.
Average time for an attacker to move from first access to other systems in 2025. The fastest was 27 seconds.
Source: CrowdStrike, 2026Share of a real espionage campaign run by an AI agent, with humans stepping in only at a few decision points.
Source: Anthropic, 13 Nov 2025Median time in 2025 for first access to be handed to a second criminal group. In 2022 it took more than eight hours.
Source: Google Cloud, Mandiant, 23 Mar 2026Moved by one employee after a video call with deepfake versions of senior managers.
Source: World Economic Forum, 4 Feb 2025Average cost of a data breach in India in 2025. Breaches here took 263 days to find and contain.
Source: IBM, 7 Aug 2025Every sale day is a working day for attackers.
These are the attacks we see most against commerce brands. Each one maps to a Fynd Guard or an agent in Fynd Secure.
51% of web traffic is now automated and 37% is bad bots. They scrape prices, hoard stock on drop days, test stolen cards and abuse coupons.
Source: Imperva, 14 Apr 2025Account takeover attacks rose 40% in a year. Attackers test breached passwords at scale and drain wallets, loyalty points and saved cards.
Source: Imperva, 14 Apr 2025A single changed script on a payment page can copy card details. PCI DSS 4.0.1 now requires brands to control and watch those scripts.
Source: PCI Security Standards Council, 30 Jan 2025Social engineering of a third party led to ransomware at M&S, hit online and store operations and cut profit by about £300 million.
Source: BBC, 10 Jun 2025; CISA and partners, 29 Jul 2025Assistants that can look up orders or issue refunds can be steered by hidden instructions. OWASP now lists these as top agentic risks.
Source: OWASP, 9 Dec 2025Voice and video deepfakes of founders and finance heads are now cheap to make and convincing enough to move money.
Source: World Economic Forum, 4 Feb 2025The rules now come with clocks.
A short view of what applies to brands selling in India. Check the official text with your legal team.
- 28 Apr 2022CERT-In Directions
Report covered cyber incidents to CERT-In within 6 hours of noticing them. Keep ICT system logs for 180 days, in India.
Source: CERT-In, 28 Apr 2022 - 31 Mar 2025PCI DSS 4.0.1 checkout rules
Requirements 6.4.3 and 11.6.1 apply: keep an inventory of payment page scripts, approve them and detect unauthorised changes.
Source: PCI Security Standards Council, 30 Jan 2025 - 13 Nov 2025DPDP Rules notified
The Digital Personal Data Protection Rules are published, with duties starting in phases.
Source: MeitY, 13 Nov 2025 - 13 May 2027DPDP security and breach duties apply
Reasonable security safeguards become mandatory. Tell the Data Protection Board and affected people without delay, and send a detailed report within 72 hours. Penalties go up to ₹250 crore.
Source: MeitY, 13 Nov 2025; MeitY, 2023
This is a plain-language summary, not legal advice.
People alone cannot keep up.
The world is short of 4.8 million security people. Most brands cannot hire a 24x7 team, and even good teams cannot read every alert at 3 am on a sale night.
Source: ISC2, 23 Oct 2024IBM found that heavy use of AI and automation in security cuts the cost of a breach sharply, yet 73% of Indian organisations it surveyed use little or none.
Source: IBM, 7 Aug 2025- Detect in seconds, not days
Guards sit inside Fynd and see attacks as they start. Agents read every signal, all day and all night.
- Contain in minutes
Safe, reversible actions run on their own. Bigger ones are prepared and sent to you with the blast radius.
- See every system in one place
Fynd properties, clouds, on-prem, SaaS, laptops and stores land in one timeline.
- Keep people in charge
You set what agents can do. Some actions are never automatic. Every action is explained and logged.
- Report inside the clock
CERT-In and DPDP clocks start on their own and drafts are ready for your team to review and submit.
- 1.CrowdStrike, 2026 Global Threat Report, 2026
- 2.Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, 13 Nov 2025
- 3.Google Cloud, Mandiant, M-Trends 2026, 23 Mar 2026
- 4.World Economic Forum, Deepfake fraud at Arup, 4 Feb 2025
- 5.Imperva, 2025 Bad Bot Report, 14 Apr 2025
- 6.IBM, Cost of a Data Breach 2025, India findings, 7 Aug 2025
- 7.BBC, M&S cyber attack coverage, 10 Jun 2025
- 8.PCI Security Standards Council, Updates for merchants validating to SAQ A (PCI DSS 4.0.1), 30 Jan 2025
- 9.CISA and partners, Scattered Spider advisory AA23-320A, updated, 29 Jul 2025
- 10.OWASP, Top 10 for Agentic Applications 2026, 9 Dec 2025
- 11.CERT-In, Directions under section 70B(6) of the IT Act, 28 Apr 2022
- 12.MeitY, Digital Personal Data Protection Rules, 2025 (Gazette), 13 Nov 2025
- 13.MeitY, Digital Personal Data Protection Act, 2023, 2023
- 14.ISC2, Cybersecurity Workforce Study insights, 23 Oct 2024
Close the gap before your next sale.
Early access is open to Fynd customers now. We start in read-only shadow mode, so nothing changes until you say so.