The numbers
CERT-In handled about 13.9 lakh incidents in 2022, 15.9 lakh in 2023 and 20.4 lakh in 2024 (Lok Sabha reply on CERT-In incidents 2020–2024). In 2025 the figure rose to over 29.44 lakh (PIB: CERT-In activity in 2025 (Jan 2026)). That's more than double in three years.
What's behind the rise
Part of the increase reflects better visibility and reporting since the 2022 directions. But the attack surface has also grown: more cloud services, more remote access, more internet-facing applications and more connected devices. Automated scanning means every exposed service is probed continuously, not occasionally.
Five controls that cut the most exposure
- Shrink the attack surface: inventory internet-facing assets and remove or protect what doesn't need to be public.
- Patch what's being exploited: prioritise known-exploited vulnerabilities over CVSS score alone.
- Harden identity: MFA everywhere, no exposed RDP, no shared admin accounts.
- Put a WAF in front of web apps: virtual patching buys time.
- Log and watch: centralise logs for 180 days and make sure someone reviews alerts.
What to do next
If you aren't sure what you expose to the internet, start with an external attack-surface review. It's quick, non-intrusive and often surprising. See our cybersecurity assessment.