Managed security baseline that gets small exporters through buyers' cyber audits
TL;DR Deskmoat runs the basic cyber defences for 20–100 person manufacturers and exporters - firewall, endpoint protection, backups, patching and a remote watch desk. What it really sells is evidence. Each year the client passes an audit against CERT-In's MSME controls, which answers the security questionnaires big buyers now send. Firms pay a monthly fee per site.
Small factories and export houses run on a few office PCs, an accounting-software server, email and an internet line some local dealer set up years ago. Default passwords stay, patches lag and the backups sit on a drive plugged into the same network.
Ransomware is hard to stop even for bigger firms. In one security vendor's 2026 survey, only one in three smaller organisations halted an attack before their data was encrypted[1]. CERT-In counted 11.5 million cyberattack incidents in India in 2021[2]. Meanwhile every company has to report listed incidents to CERT-In within 6 hours and keep 180 days of logs in India[3], and very few small firms could do either.
Deskmoat installs a managed firewall from an established vendor, endpoint protection on every PC and offline backups. A remote desk then watches alerts, applies patches and checks the backups every month. The setup follows the 15 controls and 45 recommendations CERT-In published for MSMEs in September 2025[4], so every setting maps to a line an auditor will check.
When something goes wrong, the desk contains it, restores from backup and prepares the CERT-In report for the owner to file within 6 hours. Once a year Deskmoat arranges a baseline audit through a CERT-In empanelled auditor, which CERT-In suggests for MSMEs[4]. The client gets a report it can attach to a buyer's vendor questionnaire.
The seed proposed AI-powered network protection. Small firms don't lack detection software, which is cheap, but they do lack anyone to set it up and respond. So the reframe sells a managed service with proof attached.
Regulatory note: no licence is needed to run a managed service. CERT-In directions and the DPDP Act shape what the desk has to do.
The owner pays a monthly fee per site (our estimate is ₹8,000–25,000, depending on seat count). The push often comes from a big buyer though - an auto OEM, a pharma major or an overseas brand quizzing suppliers about security. An Indian antivirus maker already sells a small-office edition[5], so owners are used to paying for security software, just not for a desk.
CERT-In's MSME controls, dated 1 September 2025, give small firms a recognised checklist for the first time[4]. The DPDP Rules notified in November 2025 add penalties of up to ₹250 Cr for failed security safeguards[6], with an 18-month phase-in. Buyers finally have a named standard to ask suppliers about.
There's no public figure for managed security spend by Indian MSMEs. The reachable base is about 5.45 lakh small and 42,017 medium enterprises on Udyam[7]. Narrower still are suppliers to big buyers that send security questionnaires, and I couldn't find a count for those. Start with one industrial cluster and measure it yourself.
Local IT dealers sell firewalls but rarely watch them. Antivirus and firewall vendors sell products and managed detection to bigger firms[1][5]. CERT-In empanelled auditors test but don't operate anything.
The gap is one provider that runs the controls and turns up at the audit with the evidence ready, priced for a 30-seat factory.
| Difficulty | Moderate (48/100) |
| Starting capital | ₹1.2–2.2 Cr |
| Time to launch | 9–12 months |
The tools are off the shelf. The hard parts are a watch desk that's cheap enough per client, site visits across an industrial belt and selling to owners who think security is the dealer's problem. Margins depend on making every install look the same.
No licence is needed to run a managed security service. The rules shape how the desk works.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't trust AI to decide on its own that an incident is over or that a backup is clean. A person should confirm both before the client gets back to work.
Want to work out the AI layer for Deskmoat? Talk to Yash →
I think this suits a founder from a managed IT firm or a security operations centre who knows one industrial cluster inside out. It's a weak fit for a product-only founder. Prove first that 20 firms in one cluster will pay monthly for at least six months, and that a buyer's questionnaire is what made them sign.
Plan for roughly ₹1.2–2.2 Cr, most of it for the watch desk team, site visits and the first year before contracts cover costs.
No licence. You need to follow CERT-In's incident and log rules, the DPDP Act and your vendors' partner terms.
Yes, small suppliers everywhere get security questionnaires from big buyers. Swap the CERT-In controls for your local baseline and check your own reporting rules.
The free Deskmoat validation kit has the line-by-line capital breakdown, the effort scoring, the rules checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for factory owners and buyers, and 5 assumptions to test. Download the kit →
Thinking about building Deskmoat or something close to it? The make-or-break work is running the watch desk cheaply enough that a 30-seat factory can afford it, and I'm happy to work through those numbers with you. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.