Security pre-test lab that readies Indian camera and IoT makers to pass
TL;DR Benchwarden is a private lab that tests Indian-made CCTV cameras, recorders and smart devices against the security rules they'll face, sorts out the paperwork and sends them to the official tester ready to pass. Device makers and importers pay per product. It works because failing a government test costs months.
Security testing is no longer optional for cameras sold in India. BIS lists CCTV cameras and recorders under compulsory registration with an added set of security essential requirements[1]. STQC has told makers that its general IoT certificates don't count for cameras under MeitY's March 2024 notification unless the product was checked against those essential requirements[2].
Most small makers and white-label importers have no in-house security engineer. They find out what the rules mean when a test fails, and then they wait for another slot. Export markets add a second layer, as the UK has enforced baseline device security since April 2024[3] and the EU's Cyber Resilience Act starts reporting duties in September 2026[4].
What it does, in regulatory terms: pre-compliance testing and advice only. Benchwarden does not certify anything. STQC and other designated bodies do that. It helps products pass first time.
The seed proposed a private tiered certificate for IoT security, and I reframed it. STQC already runs a four-level IoT certification scheme[5], so a startup's label would carry no legal weight. The useful business sits one step earlier.
Here's how it works - a maker sends samples, firmware and documents, and the lab runs the checks the official test will run. That means default passwords, open ports, firmware update signing, vulnerability handling, and parts and software lists. It also checks the line items from India's consumer IoT code of practice[6]. The client gets a gap report, help fixing the issues and a technical file in the format the certifier expects. For exporters the same evidence is mapped to the UK and EU rules.
The payer is the device maker, brand owner or importer. Typical buyers are Indian CCTV brands, contract manufacturers making for several labels, and smart-home and industrial IoT firms. They already pay testing fees to official labs. I found no published fee for STQC's IoT scheme, which issues quotes on application[5]. My estimate is ₹2–6 L per product family for pre-compliance, with retainers for firms that launch tonnes of models.
The March 2024 camera notification turned security testing into a market gate[2]. The UK PSTI regime took effect on 29 April 2024[3]. The EU Cyber Resilience Act entered into force on 10 December 2024, with its main obligations applying from December 2027[4]. So Indian makers selling at home and abroad now face three sets of security rules at once.
Nobody publishes a count of Indian makers needing CCTV security testing, or a figure for pre-compliance spending. The narrowest firm signal is regulatory - cameras sit on the BIS compulsory list[1], and STQC publishes a separate certified product list for the essential requirements[5]. If you want a first estimate then count the entries on that list.
STQC itself tests and certifies, and offers security testing services through its labs[5]. Large global testing houses run IoT security labs, but they serve big brands at global prices. In-house teams at the largest Indian camera brands do some of this themselves.
The gap is a fast, affordable partner for the many small and mid-sized makers who can't afford a failed slot.
| Difficulty | Hard (54/100) |
| Starting capital | ₹1.5–3 Cr |
| Time to launch | 9–15 months |
The hardest part is skill, because hardware and firmware security testers are scarce and expensive. Next comes credibility. Makers will pay only if your pass rate at the official lab is visibly better than going alone, and that takes a year of results to show. Lab equipment and a secure sample store add capital on top.
The lab itself needs no sector licence, because it prepares products and certifies nothing. Your clients face the regimes below, so your work has to match them.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI make the pass or fail call. A missed open port is your reputation, so a human tester signs every gap report.
Want to work out the AI layer for Benchwarden? Talk to Yash →
Here's what can go south -
I like this for a founder who has done embedded security or product certification work and can hire two strong testers. If you're a generalist planning to resell a scanning tool then it's a poor fit, honestly. Prove one thing first - that five makers will pay before a failed test, not after one.
Plan for roughly ₹1.5–3 Cr, most of it on test equipment, a shielded bench and senior testers. Accreditation adds to that if you go for it later.
No. You certify nothing, so there is no licence for the lab itself. Your clients need STQC certification and BIS registration, and your job is getting them through first time.
Yes. The UK and EU already have product security rules, so the demand is there. Map your checks to the local regime and confirm what your regulator expects from test labs.
The free Benchwarden validation kit has the line-by-line capital breakdown, the effort scoring, the certification and export-rule checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for device makers, and 5 assumptions to test. Download the kit →
Thinking about building Benchwarden or something close to it? The make-or-break work is hiring scarce firmware testers and proving a first-time pass rate. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.