Clone tests and staged upgrades for office access cards that copy too easily
TL;DR Badgemend audits the RFID badges that open office, data-centre and hostel doors, shows in a supervised test whether they can be copied, and then plans a staged switch to stronger cards and readers. Facilities and security heads pay a fixed audit fee, then a project fee for the migration plan.
A lot of access cards are far weaker than the doors they guard. MIFARE Classic, which researchers in 2015 still called the most widely deployed contactless smartcard, was shown in 2009 to be clonable by someone standing near the card for a few minutes, with some variants copied in about a second[1][2]. The "hardened" versions released later also fell to a card-only attack[2].
Indian access-control makers sell RFID cards alongside biometrics and phone credentials[3], but buyers rarely know which card technology their integrator put in years ago. Do you know what's in yours? An access log tied to named staff is personal data, and the DPDP Act expects reasonable safeguards around it[4].
Badgemend is a specialist service, not a product company. A two-person team visits a site with written permission from the owner, identifies the card and reader types in use and tries to copy a sample of volunteer badges with off-the-shelf research tools. The client sees the result live - a copied card opening a test door.
Then comes the useful part. Badgemend maps every door, reader and card type, ranks them by what sits behind each door and writes a staged plan covering which readers can be reconfigured to stronger card modes, which need replacing and in what order. It stays vendor-neutral and takes no commission on hardware, which in my opinion is the whole reason the advice is worth paying for. Follow-up visits retest after each stage.
The user is the facilities or physical security manager. The payer is usually the head of administration or the CISO at IT parks, data centres, hospitals, colleges with hostels and pharma plants. I found no published Indian price for this kind of audit, so my assumption is ₹1.5–4 lakh per site for the test and plan, with retests extra.
DPDP Rules were notified in November 2025, and the highest penalty, up to ₹250 crore, applies to failures of security safeguards[5]. CERT-In already expects incidents to be reported within 6 hours[6]. So a physical intrusion that starts with a copied badge is now a board-level data question, not only a guard-room one.
There is no public figure for how many Indian sites still run cloneable access cards, or for spending on card-system audits. The research record is firmer, with published attacks breaking both original and hardened MIFARE Classic cards[1][2]. Your first ten audits will produce the only real market data, so log card types at every site.
Access-control integrators and card makers will happily sell new hardware, but they're not neutral advisers. Penetration-testing firms sometimes include badge cloning in physical red-team work, usually as one line in a larger engagement.
I found no Indian firm that specialises in card-system audits plus a vendor-neutral migration plan, though my search was limited.
| Difficulty | Moderate (31/100) |
| Starting capital | ₹25–55 L |
| Time to launch | 3–4 months |
The testing itself is well documented and cheap. The hard part is trust, because clients have to let strangers copy staff badges and so contracts, consent and conduct must be spotless. Revenue also tops out unless you find a recurring retest or monitoring line.
No special licence is expected. Private security agency licensing covers guarding, not technical audits, but confirm that with a lawyer in your state [Requires validation].
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't trust AI to declare a door safe. Only a retest with a real card proves it.
Want to work out the AI layer for Badgemend? Talk to Yash →
Here's what can go south -
I like this as a lean small business for a physical-security or red-team professional. It won't become a venture-scale company without a software or monitoring layer later, and that's fine if you go in knowing it. Prove two things first - that five clients pay for the audit, and that two go on to fund the upgrade plan.
Plan for roughly ₹25–55 L, mostly on testing tools, a two-person field team and early sales to IT parks and campuses.
Probably not, since security agency licensing covers guarding. You still need written authorisation for every test, company registration, GST and DPDP compliance. Confirm with a lawyer in your state.
Yes, since easily copied cards are used everywhere. Check local law on authorised testing and data protection, and whether security consultants need a licence there.
The free Badgemend validation kit has the line-by-line capital breakdown, the effort scoring, the authorisation and data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for facilities and security heads, and 5 assumptions to test. Download the kit →
Thinking about building Badgemend or something close to it? The make-or-break work is earning enough trust that a client lets you copy their staff badges. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.