Breach-readiness, in plain language.
For founders who need to understand DPDP and CERT-In without a law degree or a security team.
The DPDP enforcement timeline, explained for founders
Rules notified 13 Nov 2025, hard enforcement 13 May 2027. What each date actually obliges you to do — and what "no minimum breach size" means for a 20-person startup.
Read →It Really Is Your CEO's WhatsApp Number. That Is the Problem.
India's I4C just issued a national advisory on the "Boss Scam" — malware that hijacks a CEO's real WhatsApp account to issue fraudulent payment instructions. Here is exactly how the attack works and what your startup needs to do about it.
Read →Your Boss's Voice Is Calling. It Is Not Your Boss.
AI deepfake fraud cost Indian businesses ₹70,000 crore in 2025. Attackers now fake voices, faces, and identities in real time. Here is how it works and what small businesses can actually do about it.
Read →The Tata Electronics Breach Is a Warning for Every Indian Vendor and Startup
Tata Electronics just confirmed a ransomware breach that exposed Apple and Tesla secrets. The attacker did not go after Tata directly — they walked in through a trusted connection. Here is what every Indian SME and startup vendor needs to understand right now.
Read →India's 6-Hour Cyber Incident Reporting Rule — What Your Startup Must Do Right Now
CERT-In's 6-hour mandatory reporting window is not a guideline — it's law. Here is exactly what Indian startups and SMEs must do when a breach happens, and why most will fail the clock.
Read →Top Cyber Threats Targeting Indian SMEs in 2025 — And What to Do About Them
Indian SMEs are attacked more than enterprises — and most don't know until it's too late. Here are the 6 real threats hitting Indian businesses right now, and how to stop them early.
Read →DPDP Act 2023: What Every Indian Startup Must Do Before It Is Too Late
India's DPDP Act is now law. Startups processing personal data face penalties up to ₹250 crore for breaches. Here is exactly what you need to do — and what happens if you don't.
Read →CERT-In's 6-hour rule: what counts as detection?
The clock runs from when you notice, not when the attacker got in. Why that makes fast, confirmed detection the whole game — and what "partial information is acceptable" really means.
Read →Why decoys have near-zero false positives
Real users never touch a fake server. The simple logic behind deception-based detection, and why it suits teams with no one watching a SIEM.
Read →What the Data Protection Board expects in a breach report
"Without delay" plus a detailed report within 72 hours. A walkthrough of what to include, drawn from the DPDP Rules themselves.
Read →The 181-day problem: why breaches go unnoticed
IBM puts the global average time to identify a breach at 181 days. Where that time goes, and why perimeter tools alone don't shrink it.
Read →Filing your first CERT-In report: a founder's walkthrough
The fields, the email address, the helpline, and what to write when you don't yet know everything. Based on the actual filing format.
Read →