Collects and checks vendor SBOMs for small SEBI-regulated firms
TL;DR Depwarden helps stockbrokers, fund houses and registrars that buy most of their software meet SEBI's demand for software bills of materials. It asks each vendor for an SBOM, checks it against the required fields, watches the listed components for new flaws and builds the audit file. The regulated firm pays a yearly subscription.
SEBI's cyber resilience framework of August 2024 asks regulated entities to hold an SBOM for every core and critical system, including bought, open-source and SaaS software, and to refresh it whenever that software changes[1][2]. The list of required fields runs from licence and supplier to transitive dependencies, hashes and "known unknowns"[2]. Where a vendor can't supply one for a legacy system, the board or proprietor has to sign off a written rationale[3].
A mid-sized broker may run a dozen vendor products and employ zero developers. The work is chasing vendors, reading JSON files nobody on staff understands and proving to an auditor that it all happened. And high-severity patch gaps have to close within a week[3].
What it does, in regulatory terms: a compliance and monitoring tool for the regulated firm. It is not itself regulated by SEBI, and it does not certify compliance. The firm's auditor still decides.
Depwarden starts with a register of the firm's critical software. For each product it sends the vendor a request with a portal link, accepts CycloneDX or SPDX files and scores each file against the fields SEBI expects. Gaps go back to the vendor automatically. A matching model cleans up messy component names so they can be checked against public vulnerability feeds, and the compliance officer gets a short weekly note - which vendor products carry a known flaw, which vendors are late and which legacy systems need a board note.
I narrowed the seed. It pitched continuous AI risk scoring for the whole software supply chain, which is what developer security tools already sell to companies that write code[4][5]. Small regulated firms mostly buy software, so their pain sits one step earlier, in getting and keeping the vendor's file.
The compliance officer or designated cyber official at a broker, asset manager, registrar or depository participant uses it, and the firm pays. Developer-side tools give a price anchor - one scanner's team plan starts at US$25 (about ₹2,400) a month and another charges US$25 a seat[4][5]. A broker with no developers needs something different, priced per vendor product monitored. Software vendors serving these firms are a second buyer, since one clean SBOM feed saves them answering fifty requests.
SEBI issued the framework on 20 August 2024[1] and pushed the main compliance date to 31 August 2025 for most entities[2]. FAQs followed in June 2025[3]. CERT-In published SBOM guidelines in October 2024 and a version 2.0 in July 2025, which adds cryptographic and AI bills of materials[6]. Audits against these rules are running right now.
I found no public count of SEBI-regulated entities bound by the SBOM rule, and no figure for Indian SBOM tooling spend. The signal is regulatory - the rule covers bought and SaaS software and not only in-house code[2], and it's audited every cycle. Global SBOM vendors have written India-specific SBOM guides[2], which suggests they see buyers here too.
Developer security scanners check the code a company writes and its open-source packages[4][5]. Global open-source compliance vendors sell SBOM generation and publish CSCRF guidance, but they're built for software makers. Large audit and consulting firms run SBOM projects for banks.
The gap is a cheap, self-serve tool for the buyer of software that handles vendor chasing and audit evidence.
| Difficulty | Moderate (39/100) |
| Starting capital | ₹55 L–1.1 Cr |
| Time to launch | 6–9 months |
Parsing SBOM formats is a solved problem. Vendors are the hard part, because plenty of Indian back-office software makers have never produced an SBOM and may push back. Matching vendor component names to vulnerability data without burying the compliance officer in noise takes careful tuning.
Depwarden needs no SEBI licence. The SBOM duty belongs to your customers, and you sell them a tool to meet it.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't trust AI to decide whether a firm is compliant. The firm's auditor makes that call, and a wrong name match could hide a real flaw, so a person checks every high-risk finding.
Want to work out the AI layer for Depwarden? Talk to Yash →
I'd back a founder who knows broker or fund operations and has sat through a SEBI cyber audit. If you're a pure security engineer who wants to build scanners then it's a weak fit. First prove that ten software vendors serving brokers will upload a usable SBOM through your portal within two weeks of a request.
Plan for roughly ₹55 L–1.1 Cr, mostly engineering for the vendor portal and matching, plus time to sell to brokers and other SEBI-regulated firms.
No. The CSCRF duty sits with your customers. You still follow CERT-In directions and the DPDP Act, and you need company and GST registration.
Yes, wherever regulators ask firms for software bills of materials. Check your own financial regulator's rules, since field and timing requirements differ.
The free Depwarden validation kit has the line-by-line capital breakdown, the effort scoring, the SEBI and CERT-In checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for compliance officers and vendors, and 5 assumptions to test. Download the kit →
Thinking about building Depwarden or something close to it? The make-or-break work is getting reluctant software vendors to hand over usable files, and I'm happy to help you plan that first round of asks. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.