Quarterly staff security-behaviour score built from logs firms already keep
TL;DR Vigilmark gives the board of a mid-sized Indian financial firm one number each quarter for how safely its staff actually behave - how fast they report lures, whether they use MFA and how often data leaves by the wrong route. It reads logs the firm already has. CISOs pay because regulators now ask about culture.
Indian regulators have turned staff behaviour into a board topic without giving anyone a way to measure it. RBI's 2023 IT governance direction tells senior management to build a culture of IT risk awareness and cyber hygiene, and makes a committee responsible for monitoring awareness work[1]. CERT-In gives firms six hours from noticing an incident to report it[2], so how fast an employee flags a strange email or call is now a compliance matter.
What can most firms actually show? A phishing-test click rate and a training completion log. Neither says much about whether people report real attacks. Verizon's latest breach report says lures sent to phones get about 40% more clicks than email ones[3], and most simulations still test email only.
Vigilmark is a measurement product, not a training course. It connects read-only to systems a regulated firm already runs - the mail gateway's report button, the identity provider, endpoint and data-loss tools, and the helpdesk. From these it builds a short list of behaviours, such as median time to report a suspicious message, share of staff on phishing-resistant MFA, files sent to personal mail and USB use. Each department gets a score.
Every quarter the CISO receives a board pack that maps the scores to the wording in RBI and SEBI documents. It shows the trend and the three teams that moved most. A short pulse survey adds attitudes, but behaviour carries the weight.
It plugs into whatever training vendor the firm uses rather than fighting it. By default Vigilmark scores teams and roles, not named individuals, which keeps it on the right side of staff trust and the DPDP Act.
The buyer is the CISO or head of IT risk at an NBFC, broker, asset manager, insurer or co-operative bank with a few hundred to a few thousand staff. The budget usually sits in the awareness or GRC line. I found no public Indian price list for culture measurement, and global tools hide per-user pricing behind sales calls. Expect ₹3–12 L a year per client (our estimate), with the board pack as the thing that justifies it.
RBI's IT governance direction was issued in November 2023 and names culture explicitly[1]. SEBI issued its Cybersecurity and Cyber Resilience Framework for regulated entities on 20 August 2024[4]. CERT-In's six-hour rule dates from April 2022[2]. Each of these has put boards on the hook for something they can't yet measure.
There's no public figure for spending on security culture measurement in India. The demand signal is regulatory, since the RBI and SEBI documents above cover banks, NBFCs and market intermediaries. Abroad, one UK vendor reports randomised trials across 22,000 people with a 78% fall in staff who never report[5]. That shows buyers there pay for behaviour data, but it does not size an Indian market.
An Indian awareness platform sells phishing, vishing and deepfake simulations with individual risk scores, and shows BFSI and NBFC clients[6]. That UK vendor measures more than 100 real behaviours mapped to NIST and MITRE[5]. A Nordic training vendor runs a behaviour risk console alongside its training[7].
The gap is a lightweight, India-hosted scorecard that speaks the regulator's language and doesn't ask the client to change training vendor.
| Difficulty | Moderate (34/100) |
| Starting capital | ₹60–110 L |
| Time to launch | 6–9 months |
The software is ordinary. The hard work is integration, because every client has a different mix of mail, identity and endpoint tools and each connector eats time. Defining a score a CISO will defend in front of the board is harder still. It has to be stable, explainable and hard to game.
No sector licence is needed to sell the product. Your clients' regulators set what they'll ask of you.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't use AI to score named individuals or feed HR decisions. Team-level scores keep staff trust and the DPDP Act on your side.
Want to work out the AI layer for Vigilmark? Talk to Yash →
Here's what can go south -
I think this is worth trying for a founder who has sold to Indian BFSI security teams and can build connectors fast. If you're hoping to sell to SMEs then forget it, as they have no board pressure and no logs to read. Prove two things first - that three clients' scores move when they run an intervention, and that the CISO reuses the pack.
Plan for roughly ₹60–110 L, mostly on building connectors and selling to BFSI security teams.
No sector licence. You need DPDP care over employee log data, CERT-In compliance, and the usual company registration and GST.
Yes. Regulated firms elsewhere also report on security culture to boards, so you'd map the pack to the local regulator's wording.
The free Vigilmark validation kit has the line-by-line capital breakdown, the effort scoring, the data-protection and regulatory checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for CISOs and risk heads, and 5 assumptions to test. Download the kit →
Thinking about building Vigilmark or something close to it? The make-or-break work is a score the CISO will stand behind in a board meeting. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.