Decoy logins and fake servers that alert small cooperative banks to intruders
TL;DR Lurepost plants decoys inside a small bank's network - fake admin accounts, a dummy core-banking server, bait files. No real employee has any reason to touch them, so any touch is a strong sign of an intruder. It's sold to urban cooperative banks and the IT service companies that run their systems.
India has about 1,430 urban cooperative banks[1]. RBI's graded cyber framework asks even the smallest to run two-factor login on core banking and report incidents, and asks the more connected ones to detect unusual activity, analyse logs and, at the top level, run a security operations centre[2]. Most of them can't staff one.
Buying a monitoring tool doesn't fix that either. Research on security operations centres describes analysts buried in alerts, most of them false[3]. Will a bank with two IT staff read hundreds of log alerts a day? It will not. CERT-In still expects listed incidents reported within six hours[4], which assumes somebody noticed in the first place.
What it does, in regulatory terms: an intrusion-detection tool used by RBI-regulated banks. Lurepost needs no licence itself, but it falls under the bank's IT outsourcing and vendor-risk duties.
Lurepost installs a small set of decoys. Think two or three fake servers that look like a branch core-banking node or a file share, admin credentials seeded in places attackers search, and bait documents. They do nothing useful, so a legitimate user never touches them. When something does, Lurepost sends one alert, with the source machine and what it tried, to the bank's IT head and its service provider.
The seed pitched AI that changes decoys on the fly to catch new attacks. That's costly to run and hard to trust at a small bank, so I reframed it. The decoys stay mostly static, and a model only generates names, files and folders that match the bank's own conventions so they look real. The selling point is a handful of alerts a year, each one worth reading. One honest caveat - low false-alarm rates for deception are a vendor claim that independent research hasn't tested yet[3].
The bank pays, usually from its IT budget, once its board or IT committee approves. Many cooperative banks outsource core banking and IT to service providers, and that makes those providers the natural channel because one provider can roll Lurepost out across dozens of banks. Enterprise deception products publish no list prices. My rough estimate is that you'd need to land at ₹1–3 lakh a year per bank to fit small budgets.
RBI's framework has set graded controls for these banks since December 2019[2], and CERT-In's six-hour reporting rule followed in April 2022[4]. Deception isn't exotic anymore. A global security platform bought a Mumbai deception startup in May 2021 and folded it in[5], so the idea has already proven itself in large accounts.
There's no public figure for deception spending in India. The narrowest firm number is the buyer count - 24 scheduled and 1,407 non-scheduled urban cooperative banks as of August 2025[1]. Each one falls under RBI's graded framework[2]. Treat that as a ceiling though, because the realistic target is the subset with internet or mobile banking.
That global platform, through its acquisition, sells deception to large enterprises[5]. A US deception specialist offers decoys and honeytokens across identity, cloud, network and OT[6]. Another vendor sells simple decoy devices worldwide. Indian security operations firms do serve banks, but mostly with log monitoring.
The gap is a low-cost decoy package delivered through the service providers that already run cooperative-bank IT.
| Difficulty | Moderate (42/100) |
| Starting capital | ₹60 L–1.3 Cr |
| Time to launch | 6–10 months |
Building decoys is the easy bit. Selling them to small banks is not. Cooperative bank boards buy slowly and cautiously, and service providers have to agree to deploy you. Proving value is awkward too, because a quiet decoy looks exactly the same as a useless one.
Lurepost needs no licence itself, but it sells to RBI-regulated banks, so their rules decide how you work.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI change decoys on its own inside a live bank network. The low false-alarm rate is still a vendor claim that independent research hasn't tested, so keep humans in charge of what gets deployed.
Want to work out the AI layer for Lurepost? Talk to Yash →
I like this for a founder who has sold to cooperative banks or worked at one of their IT providers. If you want big enterprise deals then look elsewhere. Prove first that a service provider will deploy Lurepost across five banks, and run a red-team test in each so the bank actually sees an alert fire.
Plan for roughly ₹60 L–1.3 Cr, mostly on security engineers and the long vendor-approval process at banks.
No licence for the product. Your bank buyers will run vendor-risk checks, and you must follow CERT-In directions and the DPDP Act.
Yes, wherever small banks lack a full security team. Check your local banking regulator's outsourcing rules, since they decide how fast you can sign.
The free Lurepost validation kit has the line-by-line capital breakdown, the effort scoring, the RBI and CERT-In checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for bank IT heads and service providers, and 5 assumptions to test. Download the kit →
Thinking about building Lurepost or something close to it? The make-or-break work is winning over the IT service providers that already run cooperative-bank systems, and I'm happy to think that through with you. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.