Startup cybersecurity · India
Security that grows one funding round at a time.
The first enterprise customer will ask for a penetration test report. An investor’s technical reviewer will ask who holds the admin keys. And the law already expects a six-hour incident report from a company of five. This page sorts what matters at each stage, from seed to Series B — and what can honestly wait.
Reviewed 24 September 2026 · 10 sources cited
The short answer
Startup cybersecurity should grow with the company. From the first customer, two duties already apply: report listed incidents to CERT-In within six hours, and keep logs for 180 days in India. DPDP Act safeguards and breach notice follow from about 13 May 2027 — the Act’s startup exemption has not been notified and could not remove them anyway. At seed, lock down cloud accounts, secrets and admin logins; before the first enterprise contract, get the product independently tested.
Why startups
Startups are not breached for being famous. They are breached for being in a hurry.
Three Indian incidents from 2025 make the point, and none of them needed a sophisticated attacker. In June, Zoomcar found that someone had taken the names, phone numbers, car registration numbers, home addresses and email addresses of about 8.4 million users — and it found out because the attacker contacted its employees. As a Nasdaq-listed company, it then had to disclose the incident to the US Securities and Exchange Commission as well.
In late August, researchers at UpGuard found a publicly readable cloud storage bucket holding 273,000 completed bank-transfer forms — account numbers, amounts and contact details, linked to at least 38 banks and financial institutions. After TechCrunch reported it, the fintech Nupay confirmed it had “addressed a configuration gap” in an Amazon S3 bucket. One setting, left open.
In May, Coinbase disclosed that criminals had bribed overseas customer-support agents to copy customer data; reporting later tied them to its outsourcing partner’s team in Indore. Nearly 70,000 customers were notified, and Coinbase estimated the incident would cost it up to $400 million. A support desk is part of the product: the people on it hold exactly the access an attacker wants.
Speed is the point of a startup, and nobody should slow down for security theatre. But each of these came down to something cheap to get right early and expensive to fix late — a storage permission, a support tool that showed too much, an intrusion nobody noticed until the attacker announced it. The rest of this page puts those few things in order, by funding stage rather than by fear.
What founders assume
Six things founders believe about security that stop being true at the first customer.
Each is reasonable on day one. Each costs more the longer it survives.
What people assume“We are too small for anyone to bother with.”
What is actually trueMost attacks are not aimed; they are found. In Verizon’s 2026 data, exploiting a known vulnerability was the most common way in — 31% of breaches where the route was known. The exposed bucket above was found by researchers looking, not by anyone who had heard of the company. Automated scanning does not check your valuation first.
What people assume“The DPDP Act exempts startups.”
What is actually trueSection 17(3) allows the government to exempt notified startups from a few duties. Nothing has been notified, and security safeguards and breach notice were never on the list. From about 13 May 2027, a seed-stage company holding customer data carries the same duty to protect it and report a breach as any other Data Fiduciary.
What people assume“Our cloud provider handles security.”
What is actually trueThe provider secures its data centres and the platform. Who can read your storage buckets, which keys sit in your code and whether admin logins need a second factor are yours — the Nupay exposure was a configuration setting, not a cloud failure. And under the DPDP Act, the company that decides why data is processed stays responsible for what its processors do; Rule 6 expects the contract to say so.
What people assume“Security testing can wait until after product–market fit.”
What is actually trueThe first enterprise customer usually decides that for you: its security review asks for a recent independent test, and the deal waits until you have one. Testing also pays for itself in the worst case. IBM’s 2026 India study found offensive security testing to be the single largest factor reducing the cost of a breach — by ₹2.47 crore on average.
What people assume“SOC 2 is the first thing to buy.”
What is actually trueSOC 2 is a CPA firm’s opinion on controls operating over months, which assumes you already have the controls and the months. Many first enterprise deals close on a scoped penetration test, a clear security overview and honest questionnaire answers; SOC 2 or ISO 27001 follows when the pipeline justifies it. SOC 2 or ISO 27001 first? walks through the choice.
What people assume“Outsourced support is the vendor’s problem.”
What is actually trueCoinbase’s customers were exposed by agents working for its outsourcing partner, and the estimated bill of up to $400 million landed on Coinbase. Give support staff the least data the job needs, mask the rest, log every lookup and actually review the logs. The same applies to freelancers and agencies with production access.
Evidence
What the numbers say to a founder
Indian figures where they exist, global ones where they do not. Each is linked to its source below.
Neither IBM nor Verizon breaks out startups. Read ₹25.5 crore as the scale a bad breach reaches across Indian organisations of every size, not as a quote for yours. The more useful signal is the direction: testing was the factor that cut the cost most.
A roadmap by funding stage
What to have in place by each round
Each stage assumes the one before it is done. The order matters more than the budget: most of the seed-stage list is configuration and habit, not purchases.
-
Pre-seed and seed
Make it hard to lose everything by accident
- Multi-factor login on the cloud console, code host, email and domain registrar — founders first
- No shared root or admin accounts, and one named owner for every cloud account and billing login
- Secrets out of the code repository and into a secrets manager, with a sweep of the history for anything already committed
- Storage buckets private by default, and an alert the moment one becomes public
- Cloud and application logs switched on and kept for 180 days, as the CERT-In Directions require
- One page that says who reports an incident to CERT-In within six hours, and how
-
Series A
Be ready for the first enterprise security review
- An independent penetration test of the product and its APIs, logged in as two customers to prove neither can see the other’s data
- Fixes confirmed by a retest, and proof of testing you can share without sending the full report
- A two-page security overview and a first set of reusable questionnaire answers
- Access reviews for production and support tools; support staff see masked data by default
- A data map — what personal data you hold, where, and which vendors process it — the start of DPDP work
- Security clauses in every contract with a vendor that processes personal data, as DPDP Rule 6 expects
-
Series B and beyond
Turn the habits into a programme
- SOC 2 or ISO 27001, chosen by where your buyers are — see the SaaS page for how to choose
- Testing after every major release, not once a year
- DPDP operations running: notices, consent records, rights requests and a rehearsed 72-hour breach report — ready for 13 May 2027, or November 2026 if MeitY’s proposed shorter timeline is adopted
- A named security owner who reports to the board, even if part-time
- A review of every tool and integration that can reach customer data
- A tabletop exercise: the attacker emails your staff at 9 p.m. — what happens in the next six hours?
Next step
Thirty minutes to find out which stage you are really at.
A call with a practitioner, not a sales script. No charge, no obligation. Bring your stack, your next deal or your next round.
- Which items on the roadmap you already have, and which the next customer or investor will ask for
- Whether you need a penetration test now, or should fix three settings first
- If testing makes sense: a written scope sized to your product, a fixed price and a retest included
- A straight answer on the DPDP startup exemption and what it means for your data
12-point self-check
Could you get through a technical due-diligence call today?
These are the security questions that come up in investors’ technical reviews and first enterprise security reviews, phrased plainly. Tick only what you could show someone this week, not what you plan to do.
Before you buy
Eight questions to ask before your first penetration test
A first test is often bought in a hurry because a deal is waiting. These questions stop it becoming a scanner export the customer will not accept. Ask them of us too.
Will you test the product logged in, as more than one customer?
Most serious flaws in a young product sit behind the login: one customer reading another’s records, an ordinary user reaching an admin action. A scan from outside will not find them. Ask for at least two test accounts for each role.
Are the APIs behind our web and mobile apps in scope?
The API is the product. If the app can call it, an attacker can call it directly, without the checks the app performs — see API security testing.
Can most of it run against staging?
Usually, yes — on a copy with realistic data shapes and no real customers. Production should be kept for what cannot be reproduced there, in agreed windows.
Who confirms each finding before it reaches us?
A person should. A report padded with unconfirmed scanner output costs an engineering sprint on noise and buries the two findings that matter.
Is a retest included, and will the report show what was fixed?
The customer will ask whether the findings were closed. A retest belongs in the price — ours is.
What can we show the customer without handing over the full report?
A summary letter, or a verifiable certificate that shows scope, date and remediation status, is usually enough — and it does not publish your weaknesses. See assessment certificates.
Will this satisfy the specific buyer who asked for it?
Some government, banking and insurance buyers require a CERT-In-empanelled auditor. SemperWise is not CERT-In empanelled; if your customer requires one, we say so before you spend anything, and can prepare you for that audit.
Will you tell us if we are not ready for a test yet?
If the seed-stage basics are missing, a test mostly rediscovers them at a higher price. A good provider says so and suggests the week of fixes that makes the test worth buying.
Where SemperWise fits
Sized for a team that ships every week
Services are people doing the work; SemperWise One is the platform that keeps the evidence current between engagements. Each row says which.
“The first enterprise customer wants a pentest report.”
A scoped, authenticated test of the product, its APIs and the cloud account behind it. Every finding is confirmed by a person, and a retest is included.
VAPT“Our product is mostly APIs and a mobile app.”
Object-level authorisation, token handling and separation between customers, tested endpoint by endpoint.
API security testing“We built fast on AWS, Azure or GCP.”
A review of identity, storage exposure, secrets and logging in the cloud account itself — where most early-stage exposure actually sits.
Cloud security assessment“We need a security lead but cannot hire one yet.”
A named senior practitioner a few days a month: the roadmap above, customer reviews, investor questions, and an incident response retainer for the bad day.
Virtual CISO“We ship every week and test once a year.”
Testing on a subscription, with findings delivered as they are confirmed and retests included, so a release that reopens an old flaw is caught in weeks.
Continuous testing“Customers want proof, not a PDF.”
An assessment certificate at a live link that shows scope and remediation status as fixes land — without publishing a finding.
Assessment certificates“The same questionnaire keeps coming back.”
Answer once with evidence. Answers retire themselves when that evidence expires, so the next customer is never told something that stopped being true.
Questionnaire automation“What does the DPDP Act mean for us?”
A fixed-scope readiness assessment: what personal data you hold, your role in each flow, and a plan dated to the Rules’ deadlines. In SemperWise One, data-principal requests arrive through a public form with the statutory clocks attached.
DPDP readinessQuestions
Startups security — answered.
What buyers in this sector ask us before they commit to anything.
Does the DPDP Act apply to startups in India?
Yes. The Digital Personal Data Protection Act has no size or revenue threshold, so a startup that holds customers’ or users’ personal data digitally is a Data Fiduciary for it. Section 17(3) lets the government exempt notified startups from a short list of duties — notice, accuracy, erasure, the Significant Data Fiduciary duties and the right of access — but nothing has been notified as of our review, and the section never covered security safeguards or breach notice. The main duties apply from about 13 May 2027. A DPDP readiness assessment sizes the work for a team your size.
When should a startup get its first penetration test?
Before the first enterprise contract is signed, not after — the customer’s security review will usually ask for a recent independent test, and the deal waits until you have one. Before that, a test mostly rediscovers missing basics, so fix those first: second factors on admin logins, secrets out of code, private storage and logs switched on. After the first test, test again after major releases rather than on a calendar. IBM’s 2026 India study found offensive security testing to be the largest single factor reducing the cost of a breach.
Should a startup get SOC 2 or ISO 27001?
Not necessarily yet. Both assume controls that have been running for a while, and SOC 2 Type II needs an observation period of months. Many first enterprise deals close on a scoped penetration test, a short security overview and honest questionnaire answers. When the pipeline justifies it, the choice depends on who buys from you: North American technology buyers tend to ask for SOC 2; European, Indian and Middle Eastern buyers and tenders more often ask for ISO 27001. Our SaaS page has a short quiz that helps decide which comes first.
Do startups have to report cyber incidents to CERT-In?
Yes. The CERT-In Directions of April 2022 apply to every body corporate, which includes a private limited company of any size. Listed incident types — including data breaches, data leaks, unauthorised access and malicious code such as ransomware — must be reported within six hours of noticing them, and logs of all ICT systems must be kept for a rolling 180 days within India. Decide in advance who files the report and keep the reporting details where everyone can find them; six hours is not the time to look them up.
What do investors look at in security due diligence?
It varies by investor and stage, but technical reviewers tend to ask the same practical things: who holds admin access and whether it is protected by a second factor, whether secrets are kept out of code, when the product was last independently tested and whether the fixes were verified, how customer data is separated, what personal data you hold and on what basis, and whether any incident has occurred. The self-check on this page turns those into twelve plain questions. Evidence counts for more than policies.
How much does a penetration test cost for a startup?
It depends almost entirely on scope — one web application, or an application plus its APIs, a mobile app and the cloud account behind them — so any single published number would be wrong for most readers. We scope in a 30-minute call at no charge, then send a written scope and a fixed price, with a retest of the fixes included. For most early-stage companies the right first purchase is small: the product and its APIs, tested logged in as more than one customer. If you are not ready for a test, we will tell you.
Is a virtual CISO worth it for an early-stage startup?
Often, from Series A. Before that, a founder or the first engineer can run the seed-stage list on this page with an afternoon of advice. Once enterprise customers, investors and the DPDP Act all start asking questions, someone has to own the answers, the roadmap and the bad day. A part-time senior practitioner does that for a fraction of a full-time hire, and hands over cleanly when you do hire. Our virtual CISO service includes an incident response retainer with a defined commitment.
What should a startup do in the first hours after a breach?
Contain without destroying evidence: revoke the credentials or keys involved, isolate affected systems and keep every log. Work out quickly whether the incident is on CERT-In’s reportable list, because that report is due within six hours of noticing it. Check your customer contracts — many require notice within a fixed period — and, from about May 2027, the DPDP Rules require notice to the Data Protection Board and affected people without delay, with a detailed report within 72 hours. Say nothing public you have not confirmed. Then find out how they got in before restoring service.
Sources
Checked by our research desk on 24 September 2026. Regulations and figures move; where a number here matters to a decision, follow it to the source.
- Zoomcar discloses security breach impacting 8.4 million users — BleepingComputer, June 2025
- Thousands of Indian bank transfer records found spilling online after security lapse — TechCrunch, 26 September 2025
- Coinbase breach tied to bribed TaskUs support agents in India — BleepingComputer, 2025
- Digital Personal Data Protection Act, 2023 (sections 8 and 17, and the Schedule of penalties) — MeitY
- 2026 Data Breach Investigations Report — Verizon, 2026
- Digital Personal Data Protection Rules, 2025 (Rules 1, 6 and 7) — MeitY, 13 November 2025
- India records its highest average cost of a data breach — Cost of a Data Breach Report 2026 — IBM, 3 August 2026
- Directions under sub-section (6) of section 70B of the IT Act, 2000 — CERT-In, 28 April 2022
- MeitY plans to cut short DPDP compliance timeline — Chambers and Partners, 23 February 2026
- Over 1 lakh startups have at least one woman director or partner among 2.12 lakh recognised by DPIIT — Press Information Bureau, 2026
Next step
Know what the next round will ask about security.
Thirty minutes, no charge. You leave knowing which items on the roadmap you already have, which the next customer or investor will ask for, and whether a test is worth buying yet. If it is, you get a written scope and a fixed price, with a retest included.