Cloud misconfiguration checks with fixes done for you, sold via cloud resellers
TL;DR Configwell scans a small company's public cloud accounts for risky settings and then fixes the important ones with the customer's okay. Indian cloud resellers and managed service providers sell it alongside the cloud bill, so startups without a security hire get protection without learning yet another tool.
On every major cloud, the customer and not the provider is responsible for settings like firewall groups, encryption and patching[1]. Small teams change those settings in a hurry and rarely look back. One cloud security vendor cites an analysis finding that 99% of cloud identities carry more permissions than they need[2].
Indian smaller firms are exposed. In a security vendor's survey 88% reported breach attempts or incidents in a year, and 43% said the lack of a dedicated security team was a top-three problem[3]. Enterprise posture tools do exist, but they spit out long alert lists that a five-person engineering team is never going to work through.
Configwell connects to cloud accounts with read-only access and runs a curated set of checks - public storage buckets, open database ports, unused admin keys, missing multi-factor login, disabled logs and unencrypted backups. Instead of hundreds of alerts, the customer sees the ten that matter most this week, each with a plain explanation.
What happens next is the real difference. For approved items, Configwell's engineers or scripted fixes make the change during an agreed window and record what changed. A one-page monthly report goes to the founder, and a log-retention check flags gaps against CERT-In's 180-day rule[4].
The scanning layer can start from an open-source scanner, which already covers hundreds of checks across the big clouds and lists an Indian cloud among unofficial providers[5]. I dropped the seed's "AI-powered" claim because fixed, explainable rules do this job better.
The startup's CTO or founder uses it, and the startup pays through the reseller that already sends its monthly cloud invoice. Resellers want this because it helps them hang on to accounts. A plausible price is ₹8,000–25,000 a month per company depending on account count (our estimate), against a security engineer's salary. The same survey found 27% of Indian SMBs already outsource part of their security[3].
CERT-In's 2022 directions made log retention and fast incident reporting a legal duty for body corporates[4]. The DPDP Act adds penalties of up to ₹250 crore for weak safeguards[6]. Both turn a forgotten bucket from an embarrassment into a liability, and most small teams haven't checked.
There's no public figure for India's small-business cloud posture market. The closest signals are about spending intent - 63% of Indian SMBs in that 2024 security vendor survey expected security spending to rise in the next year, and 27% planned to outsource some or all of it[3]. Treat those as demand hints and not a market size.
Enterprise cloud security platforms sell posture management to large enterprises[2]. Open-source scanners offer free scanning for teams who can run it themselves[5]. Cloud providers bundle native checkers with every account.
The gap is the last step - someone who actually fixes the findings for a small company, priced in rupees and sold by the reseller it already trusts.
| Difficulty | Moderate (34/100) |
| Starting capital | ₹50–95 L |
| Time to launch | 5–8 months |
Scanning is the easy part. Making changes in a customer's live cloud without breaking production is the hard part, and so is earning enough trust that a founder hands over write access. Reseller deals take months to sign, and every cloud has its own quirks.
No sector licence applies to selling cloud security services, so you need the baseline plus the security rules.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
I'd keep the actual checks as fixed rules, not AI. They need to be explainable, and no model should change a customer's cloud without a person approving it.
Want to work out the AI layer for Configwell? Talk to Yash →
I like this for a founder with cloud operations experience who enjoys services and doesn't mind running a small fix team. It's not for you if you want a pure software business with no hands-on work. First prove that five startups will grant approved-change access and stick around for three months.
Plan for roughly ₹50–95 L, mostly for engineers, the fix workflow and building reseller partnerships.
No sector licence. Follow CERT-In's incident and log rules as a service provider and act as a processor under the DPDP Act.
Yes, the same clouds and the same mistakes exist everywhere. Check local data protection law and how resellers work in your market.
The free Configwell validation kit has the line-by-line capital breakdown, the effort scoring, the CERT-In and data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for startups and resellers, and 5 assumptions to test. Download the kit →
Thinking about building Configwell or something close to it? The make-or-break work is earning write access to customers' clouds and never breaking production, and I'm glad to help you plan how to earn that trust. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.