Facilitated cyber crisis rehearsals for boards of mid-size brokers and NBFCs
TL;DR Squallroom runs half-day cyber crisis rehearsals for the boards and senior teams of mid-size SEBI-regulated firms and NBFCs. A facilitator plays out a ransomware or data-leak scenario against the real six-hour reporting clock and then hands over a scored report. Firms pay per exercise or per year, and it works because directors carry the liability but rarely practise.
Since April 2022, Indian companies have had to report listed cyber incidents to CERT-In within six hours of noticing them[1]. That clock starts before most boards even know what happened. SEBI's August 2024 cyber framework covers brokers, depository participants, mutual funds, registrars and other regulated entities[2], and its 2025 FAQs say every incident scenario must be tested in each audit period, with all stakeholders knowing their roles[3].
Directors of a 200-person broking firm are rarely security experts. When a real attack lands they have hours to decide whether to shut systems, tell clients, call the regulator or pay. How many of them have made those calls before? Very few.
Squallroom is a facilitated exercise, not a course. Before the session the team interviews the CISO and maps the firm's real systems, vendors and reporting duties. On the day, the board and CXOs sit in one room while a facilitator releases the scenario in stages over three to four hours - an encrypted trading server, a ransom note, a journalist's call, a client data sample on a leak site. A shared screen runs the clocks for CERT-In's six-hour report and the firm's own recovery targets.
A light web tool lets the facilitator send updates and records every decision and when it was made. Afterwards the firm gets a scored report and a short action list for its board minutes.
The seed proposed immersive simulation, and I dropped the headsets and gamified apps. A board will not put on VR goggles (picture it for a second), and SEBI's guidance says tabletop exercises can't stand in for live technical drills[3]. Squallroom sells the decision rehearsal that sits alongside those drills.
The CEO or company secretary pays, often at the request of the board's risk or IT committee. Directors, the CEO, CFO, CISO, legal and communications heads take part. Today large firms buy exercises from global vendors or large audit firms, and mid-size firms often just skip them. Squallroom would charge a fixed fee per exercise, with a cheaper annual plan for repeat rehearsals.
SEBI's framework (August 2024) and its June 2025 FAQs made scenario testing an audit item for a broad set of regulated firms[2][3]. CERT-In's six-hour rule[1] means a slow board decision is itself a compliance failure. RBI's push on training for co-operative banks[4] points to the same demand in banking.
I found no public figure for spending on board cyber exercises in India. The narrowest signal is the regulated buyer base under SEBI's framework[2], plus the global uptake of digital crisis exercises - one UK simulation vendor says its platform is used by more than 30% of the 100 largest US companies[5]. That is adjacent evidence, not an Indian market size.
That UK vendor sells digital tabletop exercises and crisis simulations to large global firms, including big international banks[5]. Large audit firms and CERT-In empanelled auditors in India run tabletop sessions as part of wider consulting.
The gap is a repeatable, fixed-price product for mid-size Indian firms, built on Indian rules and run by someone who has handled a real incident.
| Difficulty | Moderate (31/100) |
| Starting capital | ₹35–70 L |
| Time to launch | 3–6 months |
The software is light. The hard part is credibility in the room, because facilitators have to be senior enough that a board listens and scenarios have to be specific enough that directors take them seriously. Scaling past the founders' own time is the long-term headache.
No licence is needed to run exercises, but how you describe the service matters.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI score the board or write the final action list on its own. The facilitator's judgement is what the firm is paying for.
Want to work out the AI layer for Squallroom? Talk to Yash →
Here's what can go south -
I'd back a former CISO or incident responder with board-level presence on this one. If you're a first-time founder without that background then skip it, because trust is the product. Prove one thing first - that three firms pay for a second exercise within twelve months.
Plan for roughly ₹35–70 L, mostly on experienced facilitators and the first few client exercises.
No licence. Don't sell it as a CSCRF audit or a stand-in for live drills, and hold NDAs and professional indemnity cover.
Yes. Boards everywhere face cyber incident reporting duties. Rebuild the scenarios around the local regulator's rules.
The free Squallroom validation kit has the line-by-line capital breakdown, the effort scoring, the rules checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for CEOs and company secretaries, and 5 assumptions to test. Download the kit →
Thinking about building Squallroom or something close to it? The make-or-break work is earning the right to stand in front of a board and run its worst day. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.