Network segmentation written as code for brokers under SEBI's cyber rules
TL;DR Fencecode keeps a broker's network segmentation rules in a version-controlled file, pushes them to the firewalls and hosts it already has, and turns every change into audit evidence for SEBI's cyber framework. Mid-size and small stock brokers pay a yearly subscription. It might work because the rule now names segmentation and auditors want proof.
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) has covered every regulated entity since August 2024[1]. An August 2025 clarification asked entities to adopt approaches like zero-trust networks and segmentation, signed off by their IT committee. It also widened the critical-system scope to any machine on the same network segment as a critical one[2]. On a flat office network, that drags the back-office PC and the printer into the audit.
Brokers with 10,000 to 10 lakh clients fall into the small and mid-size tiers[3]. Most run a handful of firewalls looked after by one network engineer, with rules nobody has reviewed in years. CERT-In also expects incidents reported within six hours[4], which is tough when you can't say what a compromised machine could reach.
Fencecode starts by watching traffic for two to three weeks through flow logs and light host agents. Then it drafts a zone map - trading terminals, back office, surveillance, the order-routing servers that talk to exchanges and guest Wi-Fi. The map becomes a plain text policy file under version control. Every change is a pull request someone approves, and Fencecode compiles the approved file into rules for the firewalls and host firewalls the broker already owns.
The audit side is the actual product. Each zone and rule links to the CSCRF clause it supports, and the approval history exports as the evidence pack an auditor asks for. A drift check flags any rule someone added by hand outside the file.
This is narrower than the seed's general "segmentation for everyone". Large enterprises already buy global segmentation suites, so the opening is regulated firms too small for those tools but now named in a rulebook.
The buyer is the broker's CTO or compliance head, and the money comes out of the CSCRF budget that already pays for audits and a security operations centre. Pricing would be an annual subscription by number of hosts plus a one-time onboarding fee. There's no public price list for the big segmentation vendors to compare against, so ask brokers what they paid their last auditor before you set a number.
The CSCRF dates from 20 August 2024[1], SEBI re-sorted entities by size on 30 April 2025[3], and the 28 August 2025 clarification put segmentation into the text[2]. Each audit cycle now asks for evidence that didn't exist two years ago. Mid-size brokers have fewer engineers than the rule assumes, so tooling that writes the evidence has a real reason to exist.
I didn't find a public figure for Indian spending on segmentation. The narrow measure is the number of SEBI entities in the small and mid-size tiers. SEBI's thresholds are public[3] but there's no published count that I could find. On the adjacent side, one large tech firm's annual study puts the global average cost of a breach at US$4.99 million in 2026 (about ₹48 Cr)[5]. That's context for the board conversation, not your market.
One global vendor sells segmentation across hybrid and multi-cloud estates[6]. A large content-delivery firm's segmentation product discovers traffic, suggests policies with a phased rollout and produces compliance maps for PCI-DSS and SWIFT[7]. Open-source container network policy runs at large scale[8], but a broker's back office is mostly office desktops and a few servers.
None that I found maps rules to CSCRF clauses for brokers with 10–100 staff.
| Difficulty | Moderate (42/100) |
| Starting capital | ₹1.2–2.2 Cr |
| Time to launch | 9–12 months |
Compiling one policy file into rules for five or six firewall brands is real engineering. Discovery can't slow down trading terminals, and a bad push during market hours could cut order flow. Selling is slow too, since compliance heads buy after an audit finding and not before.
Fencecode needs no licence, but brokers will treat it as a third-party provider under SEBI's framework.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI push a rule to a firewall on its own. One wrong rule can cut the order-routing servers off from the exchange during market hours.
Want to work out the AI layer for Fencecode? Talk to Yash →
I think it's worth a look if you've run networks inside a broker or exchange and know a CSCRF auditor personally. If you're hoping to sell a general security platform then look elsewhere. Prove first that three auditors would accept Fencecode's export as segmentation evidence.
Plan for roughly ₹1.2–2.2 Cr, mostly for engineers, firewall integrations and long sales cycles with brokers.
No licence. Brokers will audit you as a third-party provider under CSCRF, and CERT-In and DPDP rules apply to you too.
Yes, financial regulators elsewhere also push segmentation. You'd remap the evidence to your own regulator's framework and the firewalls brokers use there.
The free Fencecode validation kit has the line-by-line capital breakdown, the effort scoring, the regulatory checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for brokers and auditors, and 5 assumptions to test. Download the kit →
Thinking about building Fencecode or something close to it? The make-or-break work is getting auditors to accept the evidence and never breaking a trading link, and I'm happy to help you plan around both. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.