Family-safe web filtering that regional broadband providers resell to homes
TL;DR Nestmoat gives smaller Indian broadband providers a ready-made home security add-on - network-level blocking of malware and risky sites, a check of every connected gadget and a family app under the ISP's brand. The ISP pays per active home and resells it, just like the biggest operator already does with its own product.
Homes on fibre now hang cameras, smart plugs, TVs and the kids' tablets off one router, usually with whatever settings the installer left. Families have no way to see what's connected or who each device talks to.
The risk is real enough that the UK made unique passwords, a vulnerability reporting route and a published support period compulsory for connectable products from 29 April 2024[1]. India has no matching consumer rule that I could find. Smaller firms already know the threat well, since 88% of Indian SMBs in a security vendor's survey reported breach attempts or incidents within a year[2], and plenty of them run on the same home-grade routers.
What it does, in regulatory terms: a network filtering and device-inventory service run on behalf of licensed ISPs. Nestmoat holds no telecom licence, the ISP does. Because it keeps query logs, CERT-In's 2022 directions on incident reporting and log retention apply to it as a service provider[3].
The ISP points a customer's DNS at Nestmoat, or loads a small agent on routers it supplies. Each home then gets threat blocking, optional child-safe and study profiles, a list of connected devices with flags for weak or outdated ones, and a monthly report in plain language. Support staff at the ISP get a console to switch it on, run trials and see why a site got blocked.
The seed pictured an AI box sold to households, and I reframed it. One national broadband provider already bundles a similar filter for ₹99 a month[4], so the gap isn't the tech. It's the hundreds of regional providers who can't build or support this alone.
The household uses it but the ISP pays Nestmoat a monthly fee per active home and keeps the margin on what it charges. There are price anchors - that provider's add-on is ₹99 a month after a free trial[4], and a global DNS-filtering service sells a self-serve filter for ₹159 a month or ₹1,590 a year[5]. A regional ISP might charge ₹49–99 and pay Nestmoat a third to a half of that (our estimate).
Router-level threats and smart devices have followed fibre out of the cities and into tier-2 homes. The UK's 2024 product-security regime[1] shows where rules are heading. The DPDP Act sets penalties of up to ₹250 crore for weak security safeguards[6], which pushes ISPs to treat home security as a service and not an afterthought.
There's no public figure for India's ISP-delivered home security market, and I didn't find a count of homes served by regional ISPs either. On the adjacent side, one market research firm puts India's smart-home market at US$6,426.4M in 2024 (about ₹62,000 Cr), with security and access controls at 55.02% of revenue[7]. That's device spending though, not your market.
One national broadband provider runs its own security add-on[4]. Global DNS-filtering services sell DNS filtering direct to tech-savvy users[5], with prices in rupees. Global white-label vendors serve big carriers abroad.
The gap in India is a supplier sized and priced for a provider with 5,000–50,000 homes, with Hindi and regional-language support and a console its own staff can use.
| Difficulty | Moderate (42/100) |
| Starting capital | ₹1.2–2.2 Cr |
| Time to launch | 8–12 months |
The filter itself is well understood. Reliability is the scary bit, because a DNS outage takes a whole town offline, and the sale is slow because regional ISPs want proof their support lines won't flood. Router variety makes the device checks messy too.
Nestmoat should not need a telecom licence if each ISP delivers it under its own, but confirm that with a telecom lawyer before launch.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI make the call on what a child can see beyond the profile the parent set. Filtering choices belong to the family, and over-blocking will drive cancellations.
Want to work out the AI layer for Nestmoat? Talk to Yash →
I'd try this if you have ISP or DNS operations experience and can sell to cable and broadband operators face to face. It's a poor fit if you're hoping consumers will buy security on their own, because they mostly won't. Prove first that one regional ISP can get 8% or more of its homes onto a paid add-on within three months.
Plan for roughly ₹1.2–2.2 Cr, mostly for the filtering infrastructure, the white-label app and ISP integrations.
Probably not if the ISP delivers it under its own licence, but confirm with a telecom lawyer. CERT-In log rules and the DPDP Act apply either way.
Yes, regional ISPs elsewhere have the same gap. Check local data retention and filtering laws, which vary a lot.
The free Nestmoat validation kit has the line-by-line capital breakdown, the effort scoring, the CERT-In and data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for ISPs and households, and 5 assumptions to test. Download the kit →
Thinking about building Nestmoat or something close to it? The make-or-break work is signing the first regional ISP and keeping its resolvers up every hour of the year, and that first deal is where I can help most. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.