The blog
Source-checked writing on compliance, AI security and cryptography, each article citing its primary sources so you can check the figures rather than trust them.
Resources
Things you can use without talking to us first.
Working material rather than marketing collateral. Everything here can be read in full on the page without giving us an email address. Where there is an editable or printable version — a spreadsheet, a PDF checklist — we email it, so we can send you the update when the rules change.
Available now
Short list, and it stays short.
We publish something when it is genuinely useful to the people we work with, which is not often. Everything here is maintained rather than posted and forgotten — each page carries the date its facts were last checked.
Guides
The questions buyers ask before they talk to anyone.
Cost, deadlines, checklists and comparisons for Indian compliance and security buyers. Each one cites its sources and carries the date its facts were last checked.
Tracker
DPDP deadlines tracker
Every DPDP date that is actually in the Gazette — 13 November 2026 for Consent Managers, 13 May 2027 for nearly everything else — what each stage switches on, and the proposal that could move it.
Checked 6 Nov 2026 → Cost guideISO 27001 certification cost, line by line
Every line on an ISO 27001 bill — who you pay, what recurs in years two and three, and how certification bodies work out audit days — with a checklist for comparing quotes like for like.
Checked 6 Nov 2026 → Cost guideWhat drives the price of a VAPT
Why VAPT quotes for the same system differ so much: the scope units and depth that set tester-days, when a CERT-In empanelled auditor is required, the signs of a scan sold as a pentest, and a worksheet to scope your own quote.
Checked 6 Nov 2026 → ChecklistCERT-In guidelines checklist
Every CERT-In requirement on one page — the six 2022 Directions, the FAQ that clarifies them and the 2025 audit policy — with the evidence to keep for each, a self-check and a printable PDF.
Checked 6 Nov 2026 → ChecklistSEBI CSCRF checklist
SEBI’s cyber framework as amended through August 2025: which of the five categories you are in, every requirement with the evidence to keep, the audit and VAPT clocks, and a printable PDF.
Checked 6 Nov 2026 → Assessment guideNIST CSF 2.0 maturity assessment
How to score your organisation against CSF 2.0’s 106 outcomes without fooling yourself: the 22 Categories, Profiles, why Tiers are not a maturity score, and an Excel template.
Checked 6 Nov 2026 → GuideSOC 2 for Indian SaaS startups
What a SOC 2 report is and is not, Type I versus Type II, who may sign one for an Indian company and how to check them, a staged roadmap, a readiness checklist and what the 2027 criteria change.
Checked 6 Nov 2026 → GuideHIPAA for Indian IT vendors
When an Indian IT, BPO or health-tech company becomes a HIPAA business associate, what the Security Rule asks of it, the 60-day breach clock, and how the DPDP Act still applies to the same data.
Checked 7 Nov 2026 → ComparisonRed team vs penetration testing
What each one tests, what it costs you in time and readiness, which regulators expect red teaming, and a five-question check on which one you need next.
Checked 7 Nov 2026 →Also useful
The rest of it is already published.
Most of what people ask us for is not a download. It is an answer, and those live on the site.
The FAQ
The questions people actually ask before hiring us, including the awkward ones about price, capacity and what we cannot do.
Detection coverage
The numbers behind the testing engine, published as scale rather than methodology — rule counts, CVE coverage and what that does and does not mean.
Service FAQs
Every service page carries its own FAQ covering the questions that only apply to that piece of work.
Next step
Read it, then tell us where you are stuck.
The guides and checklists are written to be used without us. If one of them tells you something you would rather not have found out, that is a good reason for a 30-minute call — no obligation, no charge.