Outletwise

Plug-in sensors that list every POS, camera and router across a chain's outlets

IoT

TL;DR Outletwise gives retail and restaurant chains one list of every connected device in every outlet - POS terminals, card machines, CCTV recorders, music and signage boxes and routers. A small sensor in each outlet listens quietly and flags devices that are exposed or acting odd. Chains pay a yearly fee per outlet.

The problem

A chain with 150 outlets may have 1,500 connected devices it has never listed. A local vendor set up each outlet's network, another one brought the CCTV recorder and a third sold the billing system. Default passwords and flat networks are common, so a weak camera recorder can sit right next to the billing PC.

Store networks are a known way in. A large US retailer's 2013 breach hit up to 110 million customers and cost it $49 million in settlements with consumers and banks[1]. CERT-In's 2025 baseline for smaller firms asks them to change default credentials and keep guest networks away from internal systems[2]. Can a chain's IT team check that by hand at 150 outlets? Not a chance.

The idea

A palm-sized Outletwise sensor plugs into a spare port on each outlet's switch or router and only listens. It recognises each device from its traffic, using a model trained on device fingerprints, and sends a summary to a central dashboard - what's in each outlet, which network segment it sits on and which outside servers it talks to. After two weeks it learns each device's normal pattern and flags changes, like a CCTV recorder suddenly sending data abroad.

The chain's IT head sees outlets ranked by risk, with short fix tickets the local vendor can act on. Outletwise never touches device settings, so billing keeps running.

The seed proposed AI behavioural analysis for IoT in general. Big vendors already sell that to large enterprises with central data centres. The reframe goes after chains whose risk is spread across hundreds of small, unmanaged outlet networks.

Regulatory note: no licence is needed. CERT-In directions and the DPDP Act apply to the chain, and to Outletwise as its processor.

Who pays

The buyer is the IT head of a retail, pharmacy or restaurant chain with 30–500 outlets. Outletwise would charge a yearly fee per outlet (our estimate is ₹6,000–15,000, sensor included). Enterprise device-visibility tools don't publish prices and are built for big single sites[3][4]. A chain already spends on outlet IT vendors, so the pitch is a small slice of that bill.

Why now

The DPDP Rules notified in November 2025 make companies tell customers when their data leaks, with penalties of up to ₹200 Cr for failing to notify and ₹250 Cr for weak safeguards[5]. Chains hold loyalty and delivery data for millions of customers. CERT-In's 6-hour reporting rule already applies to every company[6].

Market signal

I couldn't find a public figure for chain outlets in India or what they spend on network security. Treat demand as unproven until pilots show it. On the adjacent side, one device-visibility vendor reports more than 1,300 customers across 22,000 sites for device visibility[3], which shows the category sells, mostly to large firms.

Who's already doing this

Enterprise device-visibility vendors sell agentless device inventory to large enterprises[3][4]. Router and firewall vendors show connected clients but don't identify device types or track behaviour across outlets. Local IT vendors install and leave, and nobody looks at the outlet again until something breaks.

The gap is a cheap, chain-wide device view that a two-person IT team can actually run.

How hard is it?

Difficulty Moderate (48/100)
Starting capital ₹1.5–2.8 Cr
Time to launch 9–12 months

Passive capture is a known technique. The hard work is fingerprinting the POS, camera and signage models common in Indian outlets, keeping false alerts low and shipping, installing and replacing hundreds of sensors without burning cash. Every outlet has its own vendor, so setup has to work without a technician on site.

Licences and approvals

No licence is needed to run the service, but the sensor is a physical device, so check one approval.

  • CERT-In directions, issued by CERT-In. Chains must report listed incidents within 6 hours and keep 180 days of logs in India, and your data should support both from launch[6].
  • CERT-In MSME controls, including changing default passwords and separating guest networks. Use them as the report's checklist[2].
  • DPDP Act compliance before launch. Outlet Wi-Fi metadata can identify staff and customer phones, so keep metadata only and sign processor terms[5].
  • WPC equipment type approval if the sensor has Wi-Fi or Bluetooth, before import or sale [Requires validation].
  • Company registration with the MCA and GST once over the threshold.

Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.

How AI can power this business

  • Device fingerprinting. A model trained on traffic patterns names each device, so the IT head gets a list without anyone visiting the outlet.
  • Behaviour alerts. Learn each device's normal pattern and flag changes, like a CCTV recorder suddenly talking to a new server abroad.
  • Outlet risk ranking. Score outlets so the IT team fixes the worst 10 first, not the nearest 10.
  • Fix tickets. Turn a finding into a short ticket the local vendor can follow.

Don't trust a model's device label as final for anything that touches billing or payments. A person should confirm before a ticket goes to the vendor.

Want to work out the AI layer for Outletwise? Talk to Yash →

Biggest risks

  • No budget line. Chains may see outlet security as the local vendor's job and refuse a per-outlet fee.
  • Fix fatigue. If local vendors never act on tickets then the reports turn into noise.
  • Router vendors catch up. A big router or firewall maker could add device fingerprinting for free.

Our take

This suits a founder with network engineering chops and contacts among chain IT heads. If you can't manage hardware logistics then skip it. I'd want proof first that sensors in 20 outlets of two chains find at least one serious, fixable issue in most outlets, and that one chain will pay to roll it out further.

Questions founders ask

Plan for roughly ₹1.5–2.8 Cr, covering sensor hardware, the fingerprinting model and pilots across a few chains.

Do I need a licence to sell network security sensors in India?

No sector licence. If the sensor has Wi-Fi or Bluetooth, check WPC approval first, and follow CERT-In and DPDP rules on the data.

Can I start an outlet device monitoring business in another country?

Yes, chains everywhere have the same messy outlet networks. Check local radio approvals and data protection law before you ship sensors.

Download the kit

The free Outletwise validation kit has the line-by-line capital breakdown, the effort scoring, the rules checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for chain IT heads, and 5 assumptions to test. Download the kit →

Talk to Yash

Thinking about building Outletwise or something close to it? The make-or-break work is getting a chain to pay per outlet for risks its local vendors never mention, and that pitch is worth getting right before you build a single sensor. If you need a hand, you know where to find me. Talk to Yash →

Sources

  1. Wikipedia, "Target Corporation" (customer privacy section), accessed 2026-10-21. https://en.wikipedia.org/wiki/Target_Corporation
  2. CERT-In, "15 Elemental Cyber Defense Controls for MSMEs", version 1.0, 2025-09-01. https://www.cert-in.org.in/PDF/Elemental_Cyber_Defense_Controls_for_MSME.pdf
  3. Claroty, official site, accessed 2026-10-21. https://claroty.com/
  4. Forescout, official site, accessed 2026-10-21. https://www.forescout.com/
  5. PIB, "DPDP Rules, 2025 notified" (backgrounder), 2025-11-17. https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf
  6. CERT-In, "Directions under sub-section (6) of section 70B of the IT Act", 2022-04-28. https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf

For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.

Reviews

No reviews yet