Independent security tier ratings of cameras and IoT gear for bulk buyers
TL;DR Buyproof buys popular cameras, video recorders, smart locks and other connected devices off the shelf, tests their security in its own lab and gives each model a tier from one to three. Companies, system integrators and facility managers who buy in bulk pay a subscription to see the ratings and the evidence before they place an order.
If you buy connected devices in India then you have almost no public security information to compare models on. NCCS, the telecom security centre, released security requirements for smart cameras, vehicle trackers and other IoT devices on 21 April 2025, but none of them has an enforcement date yet[1]. Only NCCS-designated labs may test against these requirements, and none of the nine designated labs lists IoT devices in its scope today[2].
Meanwhile the risk lands on the buyer. CERT-In's 2022 directions make attacks on IoT devices an incident the company must report within six hours[3]. A facility manager picking between three camera brands can compare price and resolution, but not whether a model ships with a shared default password or ever gets an update.
What it does, in regulatory terms: an independent private rating, not a certification. Buyproof does not issue any government certificate. Its tiers are its own published opinion, backed by test evidence.
The seed proposed a platform that certifies devices in tiers. A private company can't grant a legal certification in India, and if makers paid for their own rating then the tiers would be worthless. So we flipped who pays. Buyproof buys devices at retail, runs a fixed set of automated and manual checks drawn from the NCCS smart camera requirement and the UK's consumer device rules[1][4] and publishes a tier. Tier one fails basics such as default passwords. Tier two meets the basics. Tier three also offers signed updates, a vulnerability-reporting route and a stated support period. Subscribers see the tier, the failed checks and a retest date. Makers can ask for a retest after a fix but they can't pay for the result.
The payer is the procurement or IT head at a company, hospital, school group or housing management firm that buys cameras and smart devices in bulk, plus the system integrators who install them. Today they go on brand reputation and the integrator's word. No public price exists for a comparable Indian service, so the number to test is our guess of ₹1–4 lakh a year per subscriber.
The April 2025 IoT requirements give Buyproof a public, Indian checklist to test against[1]. The UK has required unique passwords and a published support period since 29 April 2024[4], and the EU's Cyber Resilience Act brings reporting duties from 11 September 2026[5]. Makers who export already know these questions are coming.
No public figure exists for Indian spending on IoT security ratings, and we didn't find one for bulk camera buying either. The narrow signal is the gap in testing capacity - four IoT requirements released, no enforcement date and no designated lab scoped for them[1][2]. An adjacent signal is that IoT attacks are already reportable incidents[3].
The designated labs, including global testing firms' Indian arms, test routers and Wi-Fi gear for makers who pay them[2]. In the UK and EU, consumer groups have published security tests of smart devices, which shows the rating model can work. We couldn't confirm an Indian equivalent. The gap is an independent, buyer-funded rating built for Indian bulk procurement.
| Difficulty | Moderate (41/100) |
| Starting capital | ₹60 L–1.1 Cr |
| Time to launch | 6–9 months |
Testing devices is well understood. The hard bits are keeping enough models rated to matter, retesting after firmware updates and defending a low tier when a brand's lawyer calls. Selling is slow too, because most buyers have never been asked to weigh security against price and they won't thank you for the extra homework.
No licence is needed to publish an independent rating. What you can't do is call it a certification.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI assign a tier. Every rating must rest on a documented, repeatable test that a person ran and can defend if a brand pushes back.
Want to work out the AI layer for Buyproof? Talk to Yash →
Here's what can go south -
This suits a founder with security-testing skills and the stomach to publish unpopular results. If you want device makers as friendly customers then look elsewhere, honestly. Prove one thing first - that ten bulk buyers will pay for ratings on the 30 camera and recorder models they actually choose between.
Plan for roughly ₹60 L–1.1 Cr over 6–9 months, covering a test lab, devices bought at retail and security testers.
No licence is needed to publish an independent rating, as long as you never present it as a government certification. Formal testing stays with NCCS-designated labs.
Yes. The UK's product security rules and the EU Cyber Resilience Act give public checklists to test against, though you'd need to check local defamation law before publishing low tiers.
The free Buyproof validation kit has the line-by-line capital breakdown, the effort scoring, the rules checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for procurement heads and integrators, and 5 assumptions to test. Download the kit →
Thinking about building Buyproof or something close to it? The make-or-break work is rating enough models, fairly enough, that buyers pay and brands can't fault the method. I'd love to poke holes in your test plan with you. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.