Five-minute cyber drills for co-operative bank tellers, clerks and directors
TL;DR Branchdrill sells urban co-operative banks a phone-first course of short cyber drills in Marathi, Gujarati, Hindi and other regional languages, built around the frauds that hit small banks. The bank pays per seat. It might work because RBI expects awareness training and plenty of these banks still run it as a hall lecture.
India still had 1,457 urban co-operative banks at the end of March 2025[1]. Most are small, run on a vendor's core banking system and have no security team beyond one officer. RBI's cyber security vision for these banks lists an awareness and training framework for every single one[2].
In practice, training often looks like the session one Vasai bank ran, with every director, branch manager and clerk packed into one hall for a talk by an outside firm[3]. Will a teller who hears a talk once a year still trust a "branch manager" on a chat app asking for a password reset? Very likely, yes.
Generic courses don't help much either. They talk about corporate email and not the core banking terminal, the cheque desk or the RTGS approver.
Branchdrill is a mobile course built only for co-operative bank roles. A teller gets a five-minute weekly drill - a fake call from "the core banking vendor", a customer asking to photograph the screen, a USB stick left at the counter. A director gets a monthly ten-minute case on a board decision, such as approving an outsourced IT contract or reading an incident report.
Every drill is in the staff member's own language and uses screens that look like the bank's own systems. Streaks and a branch leaderboard keep people coming back, but the real product is the record of who finished what, who failed the phishing test and who improved. The bank's CISO or IT officer can print that record for an RBI inspection or a board meeting.
I kept the seed's idea of sector-specific micro-learning and narrowed it to one sector where the buyer list is public, the regulator has asked for training and nobody tailors content to the job.
The bank pays, usually through its CEO or IT officer with board approval, and staff and directors are the users. Today these banks pay an empanelled firm for a classroom session[3] or buy a general awareness tool. One Indian awareness platform, for example, sells phishing simulation plus a library of more than 2,000 content items[4]. Branchdrill would charge per seat per year, with a federation-level deal to reach the smallest banks.
The DPDP Rules of 2025 add data-handling duties that banks are now folding into staff sessions[3]. CERT-In's directions require incidents to be reported within six hours[5], so a clerk has to know to escalate within minutes, not days. RBI keeps merging weak banks[1], which leaves fewer, larger buyers with bigger IT budgets.
There's no public figure for what co-operative banks spend on security training. The buyer count is firm though - 1,457 urban co-operative banks[1], plus district central and state co-operative banks. The skills gap goes wider than banking, and DSCI found 63% of enterprises say candidates lack hands-on skills[6]. Treat that as adjacent context, not your market.
Awareness platforms sell phishing tests and content libraries across sectors[4]. CERT-In empanelled consultancies run classroom sessions for banks[3]. Hands-on hacking-lab platforms train security staff, not tellers[7].
I found nobody building role-based, regional-language drills around a co-operative bank's branch floor and boardroom. That gap is narrow though, so expect a generic vendor to add a banking pack the moment you show it sells.
| Difficulty | Moderate (29/100) |
| Starting capital | ₹40–75 L |
| Time to launch | 4–6 months |
The software is simple. Content and selling are the hard parts. Each drill has to feel like a real branch in Kolhapur or Rajkot, in the right language, and that needs writers who know banking. Sales run through boards that meet monthly, and every bank wants a reference from a bank it already trusts.
No licence is needed to sell training. Your buyers are regulated, though, and that shapes the product.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI decide which staff are a risk to the bank or feed anything into HR decisions. And never use real customer data in a drill.
Want to work out the AI layer for Branchdrill? Talk to Yash →
I like this for a founder who has worked in or sold to co-operative banks and can write in two regional languages. If you expect enterprise-sized contracts then you'll be disappointed. Prove first that five banks renew after a year and that phishing-test failure rates fall between the first and fourth quarter.
Plan for roughly ₹40–75 L, mostly on regional language content and selling bank by bank.
No licence to sell training. You need DPDP processor terms, written approval for each phishing campaign, and the usual company registration and GST.
Yes, where small or community banks face cyber rules from their regulator. You'd remap the drills to the local regulator's guidance.
The free Branchdrill validation kit has the line-by-line capital breakdown, the effort scoring, the rules checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for bank officers and directors, and 5 assumptions to test. Download the kit →
Thinking about building Branchdrill or something close to it? The make-or-break work is getting the first five bank boards to sign and keeping them past year one, and I'm happy to help you plan both. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.