Monthly plant-floor and office cyber risk register for mid-size process plants
TL;DR Kilnward gives mid-size Indian process plants, such as bulk-drug and speciality-chemical units, one ranked list of cyber risks across the plant floor and the office. A passive sensor and a scan feed a monthly register with the ten fixes that matter most. Plant owners pay a yearly fee, priced well below enterprise platforms.
A typical mid-size plant runs PLCs, SCADA screens and desktop engineering PCs a few metres from office laptops, often on networks that were joined for convenience. Office IT sits with a vendor and the plant floor sits with the automation contractor, so nobody owns the risk in between.
The rules already assume someone does. CERT-In's 2022 directions list attacks on SCADA and operational technology systems, and on IoT devices, among incidents a company must report within six hours, and require logs of all ICT systems kept for 180 days in India[1]. Most mid-size plants couldn't meet that today. When AIIMS Delhi was hit, about 50 servers were compromised and systems stayed down for over two weeks[2]. A plant that stops for two weeks misses dispatches and eats contract penalties.
Kilnward puts a small sensor on a mirror port of the plant switch and listens for two weeks. It builds an inventory of controllers, HMIs, engineering stations and anything that reaches the internet. A light scan covers office IT. Each finding is ranked by how easily it could be reached and what would stop if it failed, so a remote-access tool left open on an engineering PC ranks above an old printer.
The output is a monthly register written for a plant head, not a security analyst, with an owner and a deadline for each fix plus a ready CERT-In incident contact sheet. The seed called for AI-powered scoring. We think rules plus public vulnerability data are enough to rank risks well at the start, and anomaly detection can come later once there's data to test it against. Academic models of cross-domain risk scoring look promising on test datasets[3], but they aren't proven in Indian plants.
The user is the plant's maintenance or automation head. The payer is the owner or CFO of a single-site or two-site company, often an exporter whose overseas customers have started sending security questionnaires. Enterprise platforms publish no prices and sell through partners[4][5]. I'd price Kilnward per site per year, at a guessed ₹5–12 lakh that you must test.
The CERT-In six-hour reporting rule and 180-day log duty have applied since 2022[1], and plants are slowly being asked to prove they can meet them. Telecom security requirements published in April 2025 for IoT cameras and trackers show the government moving down to connected devices[6]. Cheap sensors and open vulnerability feeds now make a plant-sized product possible.
There is no public figure for what mid-size Indian plants spend on OT security. The demand signal is regulatory - SCADA and OT attacks are already reportable incidents[1], so every plant with SCADA carries the duty whether or not it has a tool. Treat willingness to pay as unproven until a plant signs.
One global OT vendor sells sensors and a cloud console with risk and vulnerability management for industrial sites[4]. Another sells continuous threat detection with exposure management[5]. Both serve large enterprises through partners, and both are built for security teams. Indian automation contractors sometimes do one-off audits. The gap is a recurring, priced register that a plant without a security team can read and act on.
| Difficulty | Moderate (50/100) |
| Starting capital | ₹90 L–1.6 Cr |
| Time to launch | 9–12 months |
Passive monitoring is safe for plant networks, but plant heads fear anything new on the floor, so getting access takes time. Recognising older and local controller brands from traffic is the hard engineering bit. And selling to owners who've never had an incident is slow work.
No sector licence is needed to sell monitoring and advisory services to private plants. The rules that bite are your clients' reporting duties.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't trust AI to judge what's safe to change on a running plant. A wrong call can stop a production line, so a person who knows the process signs off on every fix.
Want to work out the AI layer for Kilnward? Talk to Yash →
Here's what can go south -
This suits a founder who has worked in plant automation and knows how owners in Gujarat or Telangana buy. If you're a security analyst who has never walked a plant floor then I'd pass. Prove one thing first - that three plants will pay for a second monthly register after seeing the first.
Plan for roughly ₹90 L–1.6 Cr over 9–12 months, mostly on OT security engineers, sensors and pilot plants.
No sector licence for selling to private plants. You need company registration and DPDP compliance, and your register should help clients meet CERT-In's reporting rules.
Yes, mid-size process plants everywhere face the same gap between enterprise tools and no security at all. Check local incident reporting rules first.
The free Kilnward validation kit has the line-by-line capital breakdown, the effort scoring, the rules checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for plant heads, and 5 assumptions to test. Download the kit →
Thinking about building Kilnward or something close to it? The make-or-break work is getting a sensor onto plant networks that contractors guard closely, and I can help you plan that first pitch. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.