Listen-only control-network monitoring for discom substations and water works
TL;DR Mirrorport puts listen-only sensors on the control networks of state power distribution companies and city water utilities. It learns what normal SCADA traffic looks like and raises an alert, with context, the moment something new talks to a breaker or pump. Utilities pay per site, through tenders.
India's grid has already been probed. In early 2021 a threat-intelligence firm reported that a China-linked group had targeted ten Indian power-sector organisations, including four of the five Regional Load Despatch Centres, plus two seaports[1]. CERT-In now lists attacks on SCADA and operational technology among incidents that must be reported within six hours[2].
And yet most distribution substations and pumping stations can't see their own control traffic. They run old protocols with no login, on networks stitched together by different vendors over many years. If someone changes a setpoint then the first sign may well be an outage.
What it does, in regulatory terms: passive monitoring and alerting only. Mirrorport never sends commands to field devices, so it cannot trip a breaker or stop a pump by mistake.
Here's how it works. A rugged sensor plugs into a mirror port on the substation or plant switch. It decodes industrial protocols such as Modbus, DNP3 and IEC 61850, builds an inventory of controllers and relays and learns the normal pattern of who reads and writes what. A behaviour model flags new devices, odd write commands, firmware changes and remote logins outside maintenance windows. Alerts go to the utility's own security team or a shared Mirrorport desk, with a plain account of what changed and which asset it touches.
The seed's mechanism (passive, AI-assisted behaviour analysis) is sound, so we kept it and narrowed the buyer. Global vendors sell to large plants and refineries, and Mirrorport goes after the many small, remote substations those vendors find too costly to cover.
The users are the utility's SCADA engineers and its information security officer. The buyer is the discom or water board, through public tenders that are often funded by central schemes. Global OT platforms sell sensors and central consoles[3][4], but they publish no India prices. Our working guess is a yearly fee of ₹2–5 lakh per substation, and you should test it against tender data.
The RedEcho disclosure in 2021 pushed grid security up the agenda[1]. The CERT-In directions of April 2022 made six-hour reporting of OT incidents mandatory[2]. The Central Electricity Authority also issued cyber-security guidelines for the power sector in 2021. We couldn't load that document, so confirm its current requirements directly.
We found no public figure for what Indian utilities spend on OT security monitoring. The strongest signal is the documented targeting of load despatch centres[1] plus the legal duty to report OT incidents[2]. Global vendors have built large businesses on this need[3][4]. Treat them as proof of demand elsewhere, not as an Indian market size.
One global OT vendor sells network sensors, central management and threat intelligence for OT and IoT[3]. Another sells continuous threat detection for industrial sites[4]. Both work through system integrators in India. One Indian OT security brand no longer shows up on its parent's product site[5]. The gap is a cheaper sensor and a managed desk sized for hundreds of small substations.
| Difficulty | Hard (62/100) |
| Starting capital | ₹3–5.5 Cr |
| Time to launch | 12–18 months |
Two things make this hard. Building protocol decoders and baselines that hold up on messy, mixed-vendor substation networks takes deep OT skill. And selling to state utilities means tenders, empanelment and long payment cycles, so you need enough cash to survive 12 months between bid and payment and that's not a small ask.
There's no licence to run passive monitoring, but selling to utilities brings a stack of rules before your first sensor goes in.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
AI must never send a command to a field device or decide an alert is harmless. Mirrorport stays listen-only, and the utility's engineers act on what it finds.
Want to work out the AI layer for Mirrorport? Talk to Yash →
Here's what can go south -
I'd back this only with a founding team that includes someone who has commissioned SCADA systems for an Indian utility, plus a security engineer. If you don't have the capital or the patience for government buying then skip it. Prove one thing first - a paid pilot at a state discom with fewer than five false alerts per site per week.
Plan for roughly ₹3–5.5 Cr, mostly on rugged sensors, protocol engineering, a monitoring desk and long public tenders.
No licence for passive monitoring, but you must meet CERT-In directions, the CEA power-sector cyber guidelines and any NCIIPC vetting, and usually bid through an empanelled integrator.
Yes, since small substations and water works everywhere are under-covered. Check the local grid cyber rules and how utilities there buy security services.
The free Mirrorport validation kit has the line-by-line capital breakdown, the effort scoring, the CERT-In and utility-procurement checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for utility engineers and security officers, and 5 assumptions to test. Download the kit →
Thinking about building Mirrorport or something close to it? The make-or-break work is winning a first paid utility pilot and then surviving the tender cycle, and I've seen plenty of good tech die in that gap. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.