Finds weak CCTV cameras and recorders on office networks and fences them off
TL;DR Lensmarshal is a small probe plus dashboard that finds every camera, recorder and door controller on a company network, checks firmware and passwords, and moves risky units into a quarantine segment automatically. Factories, hospitals, campuses and office parks pay a yearly fee per site.
India now treats CCTV as a cybersecurity product. BIS lists CCTV cameras and recorders under compulsory registration with an added set of security essential requirements[1], and STQC runs the testing and certification scheme, which includes penetration testing[2]. A camera maker's summary says non-compliant cameras couldn't be sold from 1 April 2026, and that the requirements cover secure firmware updates, no hardcoded credentials, encryption and tamper resistance[3].
That fixes what gets sold next. It does nothing for the cameras already bolted to walls, many put in by a local integrator, never updated and sitting on the same network as billing or HR systems.
The seed wanted hardware-rooted trust with automated response for physical security devices. You can't give an installed camera a new trust chip, so I reframed it - watch them from the network instead.
A small probe box plugs into a switch port at each site. It discovers cameras, recorders, access-control panels and intercoms, identifies make, model and firmware, and checks for default or shared passwords, open remote-access services and models that aren't on the certified list. Each device gets a plain risk score.
When a client allows it, the probe asks the managed switch to move a risky unit into an isolated VLAN, so it still records but can't reach anything else. Facilities and IT see one dashboard and a monthly report they can hand to auditors or insurers. The product scans only networks whose owner has signed an authorisation.
The user is the facilities or IT manager at a site with 50–2,000 cameras. The payer is usually the IT or security head, sometimes the facilities budget. There's no public price for this service in India, so my assumption is ₹40,000–2 lakh per site per year depending on device count, sold directly or through the integrators who installed the cameras.
STQC's CCTV procedure was issued in May 2024[2], and the sale cut-off for cameras without the essential requirements arrived on 1 April 2026[3]. Buyers are now asking whether older units on their networks meet the same bar. CERT-In wants incidents reported within 6 hours[4], and footage of people counts as personal data under the DPDP regime[5].
I found no public figure for the number of CCTV cameras installed in Indian enterprises, or for spending on camera security. The firmer signal is that the government has made security testing compulsory for every camera sold[1][3]. If you want a real number then size it bottom-up - count camera-heavy sites (hospitals, plants, campuses) in one city and ask integrators how many they maintain.
One US vendor checks firmware integrity on enterprise devices including IoT and network gear[6]. Global asset-visibility vendors cover unmanaged devices for large enterprises at enterprise prices. Camera makers offer cloud dashboards, but only for their own brand.
The gap is a mixed-brand, mid-market tool sold in rupees through Indian integrators.
| Difficulty | Moderate (40/100) |
| Starting capital | ₹60 L–1.2 Cr |
| Time to launch | 5–8 months |
Fingerprinting dozens of camera brands and firmware versions takes steady lab work. Automatic isolation needs managed switches, which many sites lack, so some clients will only ever get reports. Integrators can be allies or blockers, and it depends mostly on whether the findings embarrass them.
Lensmarshal needs no sector licence. What it does need is the network owner's permission, every time.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI isolate a device on its own. Cutting off the wrong recorder in a hospital or a bank is a real incident, so a person approves every move.
Want to work out the AI layer for Lensmarshal? Talk to Yash →
Here's what can go south -
I think it's a reasonable bet for a founder who has worked in network security or camera installation and can earn integrator trust. If you want a pure software sale with no site visits then this isn't it. Prove two things first - that one integrator will resell it, and that half of pilot sites act on the findings within a month.
Plan for roughly ₹60 L–1.2 Cr, mostly on building the probe and dashboard and on early pilots with integrators.
No sector licence, but you need written authorisation from every network owner. Add the usual company registration, GST, CERT-In duties and DPDP safeguards.
Yes, since weak cameras are a problem everywhere. Check local computer misuse law on scanning, your data protection law and any national camera rules.
The free Lensmarshal validation kit has the line-by-line capital breakdown, the effort scoring, the CCTV and data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for IT heads and integrators, and 5 assumptions to test. Download the kit →
Thinking about building Lensmarshal or something close to it? The make-or-break work is getting integrators to sell a product that may expose their past installs. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.