Tracks new flaws in firmware already shipped, for Indian device exporters
TL;DR Romsift keeps a parts list for every firmware version an Indian device maker has shipped, and keeps watching it for years. When a new flaw is published in a library inside, it tells the maker which products and customers are hit. Exporters to Europe and Britain pay per product line each year.
Firmware is where connected devices hide their weak spots. One large study unpacked about 32,000 firmware images and found 38 new vulnerabilities across 693 of them, which spread to over 123 products because makers reuse the same code[1]. Old open-source libraries, default logins and leftover debug services are the usual suspects.
Indian device makers often assemble products from imported boards and vendor software kits, and plenty of them can't say exactly what's inside their own firmware. That was fine when buyers only checked price. It isn't fine now that India's BIS registration list for CCTV cameras and recorders carries a note on essential security requirements[2] and export markets are writing firmware security into law.
What it does: after-sale vulnerability tracking for the maker's own firmware. Romsift is a tool for the device company, not a test lab or certification body. Pre-launch lab testing is a separate job, and Romsift starts once products are in the field.
The maker uploads a firmware image or connects its build pipeline. Romsift unpacks it, builds a software bill of materials, matches components against public vulnerability lists and checks for hard-coded credentials, weak crypto and exposed services. Every shipped version stays on file. When a new advisory lands, Romsift checks it against all of them and tells the maker which models, versions and export batches carry the flaw, how serious it is and what to tell buyers. That output doubles as the record a maker needs to show it handles flaws for the life of a product. It runs on open-source analysis engines such as EMBA[3], and the value Romsift adds is Indian chipset support, triage and plain reporting.
The users are firmware engineers and quality heads at Indian CCTV, router, smart-meter and appliance makers. The payer is the founder or head of engineering, the person who has to answer export buyers when a new flaw hits the news. Global firmware platforms serve large makers and publish no prices[4][5]. Our starting guess is ₹3–8 lakh per product line per year.
The EU Cyber Resilience Act entered into force in December 2024. Makers must report actively exploited flaws from September 2026, and its main duties apply from December 2027[6]. The UK's product security rules on passwords and update periods took effect in April 2024[7]. So if you sell into Europe or Britain then you now need firmware evidence, not just a price list.
No public figure exists for what Indian device makers spend on firmware security testing. The firmest signals are legal - CCTV sits on India's compulsory registration list with a security note[2], and the EU and UK deadlines are fixed[6][7]. Global vendors built around these duties[4][5] show demand in Europe and the US, but they don't size an Indian market.
One European vendor offers automated firmware analysis, SBOM management and Cyber Resilience Act readiness for device makers[4]. A US vendor analyses firmware and binaries and produces compliance evidence for sectors such as medical devices and energy[5]. A free, open-source analyser exists[3] that skilled teams can run themselves. The gap is a priced, supported service for small and mid-size Indian makers who don't have a product-security team.
| Difficulty | Moderate (42/100) |
| Starting capital | ₹60 L–1.1 Cr |
| Time to launch | 6–9 months |
The core analysis already exists in open source, so the work lies elsewhere. Unpacking firmware from the cheap chipsets common in Indian products often breaks generic tools. Cutting hundreds of raw findings down to the ten that matter needs real security judgement, and that judgement is what makers will actually pay for.
Romsift itself needs no licence to operate. The rules that matter belong to your customers, and the product exists to help them meet those.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI decide alone that a flaw is harmless. A missed critical issue in shipped devices is exactly the failure customers are paying you to prevent, so a person signs off on every severity call.
Want to work out the AI layer for Romsift? Talk to Yash →
Here's what can go south -
I like this for a founder with embedded security experience and contacts among Indian device exporters. If you're hoping open source alone will be the product then it won't be. Prove two things first - that five exporters will pay to have their shipped versions tracked, and that two of them issue a fix after an alert.
Plan for roughly ₹60 L–1.1 Cr over 6–9 months, mostly on security engineers who can unpack and triage firmware.
No licence is needed for the service itself. You need company registration and DPDP compliance, and your customers handle BIS registration and export rules.
Yes. The EU Cyber Resilience Act and the UK's product security rules already push makers there to track flaws for the life of a product, so demand may be stronger outside India.
The free Romsift validation kit has the line-by-line capital breakdown, the effort scoring, the device-rules checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for device makers, and 5 assumptions to test. Download the kit →
Thinking about building Romsift or something close to it? The make-or-break work is matching new advisories to shipped versions without drowning makers in noise, and I'm happy to think that through with you. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.