Everyone wants to put AI for threat detection in the pitch deck. Fewer founders ask what the AI is actually allowed to decide.
I'll use four ideas from the directory to show where AI earns its keep and where a human has to stay in charge. Only two of them are security products. The other two are here because they spot a different kind of threat.
The pattern in all four
Each of these products looks at a lot of messy data and flags the small part that matters. That's what AI is good at. The trouble starts when the flag turns into an action nobody checked.
1. Finding your personal data online
Unlistly is a removal service for Indians whose phone numbers, home addresses or ID scans are easy to find online. It searches, files takedown requests through each platform's own process and re-checks every quarter. It costs ₹30–60 L over 3–5 months.
Where AI helps:
- Searching thousands of pages and old PDFs for one person's details.
- Matching near-duplicates, like a number written three different ways.
- Drafting takedown requests in the format each platform wants.
Where not to trust it:
- Deciding a match is really your customer. Two people share names all the time. A wrong takedown is a complaint waiting to happen.
- Promising results. Many Indian sites ignore requests. Selling "be invisible online" will lead to refunds.
The DPDP Act and Rules 2025 help here. Once fully in force, businesses must act on erasure requests within ninety days. Whether a customer can authorise you to file for them is still a question for a lawyer.
2. Catching hidden ads and fake buzz
Postproof tells a D2C brand what its influencer campaign actually did. It checks each paid post for a proper ad disclosure, reads the comments in Hindi, Hinglish and regional languages, and ties each creator to coupon and link sales. It costs ₹40–75 L over 5–8 months.
Where AI helps:
- Reading comments in mixed languages at scale, and sorting buying intent from complaints.
- Spotting posts where the disclosure is missing or buried. ASCI and CCPA rules say paid posts need a prominent disclosure, and hashtags buried in text fail.
Where not to trust it:
- Calling a creator a fraud. Sarcasm and slang fool models. A human should review anything that goes in a report with a creator's name on it.
3. Spotting new hires who are about to leave
Questlane gives remote new hires at Indian tech firms a 90-day path of small real tasks, a buddy and scheduled manager check-ins. HR pays per hire. It costs ₹40–70 L over 4–6 months.
The "threat" here is quiet attrition. AI helps by noticing a new hire who has stopped finishing tasks or skipped two check-ins, and nudging the manager. Don't trust it to score people. Under the DPDP Act this is employee data, and a flight-risk score in an HR file is the kind of thing that ends trust fast.
4. A health risk in your snack drawer
Tastetrail sends a box of 12 small lower-sugar snack packs, learns what you like, and matches future boxes to your ratings. It costs ₹50–90 L over 4–6 months.
It's the odd one out, and I like it as a lesson. AI helps with taste matching. Don't let it make health claims. Tastetrail needs an FSSAI registration or licence and must follow the labelling rules. "Lower sugar" on a pack is a regulated statement, not a marketing line the model can write.
Where AI adds risk in any detection product
- False positives. Every wrong flag costs trust. Track your false flag rate from day one and publish it to customers.
- Silent misses. A tool that misses one serious case can lose the account. Keep a sample of "all clear" results for human review.
- Data you didn't need. Detection products want more data. The DPDP Act says take only what you need. Listen to the law.
- Automated action. Flag, then let a person act. That one rule fixes most of the problems above.
My take
AI for threat detection is worth building on when the job is reading too much data for a person to read. It's a bad idea when the job is judging a person. If your product does the first and leaves the second to a human then you'll sleep better and sell more easily.
For more, see the AI ideas and the cybersecurity ideas.
Searching and sorting large amounts of messy data so a person reviews only the flagged part.
Can AI file takedown requests on its own?
It can draft them. A person should confirm the match is really the customer before anything is sent.
Does the DPDP Act apply to detection tools?
Yes, whenever they handle personal data. Collect only what you need and get consent right.
Talk to Yash
If you're adding AI to a detection product and want to work out where a human must stay in the loop, I'm happy to think it through with you. Talk to Yash →
For illustration only. Ideas are hypothetical and names fictional; sourced facts may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.