What should an Indian startup's first security budget be?
Key takeaways
- Rs 1,50,000 for the first year covers one external VAPT, identity and cloud hygiene, licences, and a monthly incident retainer for a ten-person startup.
- A monthly incident-response retainer of Rs 10,000 to Rs 25,000 is the cheapest insurance a startup can buy, because it replaces a panic engagement.
- DDoS and WAF protection for a single public application typically adds Rs 5,000 to Rs 30,000 a month depending on bandwidth and managed service level.
- Budget for 180-day log retention from month one, because CERT-In directions apply to every legal entity in India regardless of headcount.
- Re-baseline the budget at each funding round, since the cost of an audit is small next to the cost of a diligence failure.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
How should the first security budget be split?
Split it into four lines you can name to an investor. Testing, roughly Rs 75,000, covering one VAPT of the product with authenticated roles and a retest included. Identity and cloud hygiene, roughly Rs 25,000, which is mostly engineer time to enforce MFA, fix IAM permissions and remove long-lived access keys, not a purchase. Licences, roughly Rs 30,000, for email protection, endpoint protection and a password manager, priced per seat. And a retainer, Rs 15,000 a month, with an incident-response firm, which buys a phone number, a stated response time and a place to escalate. Resist any vendor selling a 12-month monitoring contract to a ten-person company, because there is not yet enough alert volume to justify it.
What should a startup not spend money on?
Three things. Large enterprise platforms sold as 'security posture management' when the company has three cloud accounts. Annual certification programmes, ISO 27001 or SOC 2, which are valuable later but consume consulting and audit fee for a team with no internal auditor. And hardware or appliances. A startup buying a firewall appliance to protect a workload that runs in AWS is spending on a box in an office. The equivalent spend is a well-configured cloud firewall, a private subnet for the database, and a second administrator for every production console, which is free if you are disciplined about it. If a salesperson cannot say which of your actual assets it protects, it is not budget.
When is it worth spending more?
Three events force a budget increase. The first is a funding round that brings institutional investors with a security questionnaire, which typically expects an independent test report, MFA evidence and an incident-response plan within the last 12 months. The second is the first enterprise customer sending a vendor security review, which is where a 40-page questionnaire turns into paid consulting hours. The third is holding data the DPDP Act 2023 treats as sensitive, such as health, financial or children's information, which brings breach notification, consent records and 180-day log retention into scope. Plan the step-up when one of these happens, not before, and reallocate rather than simply adding.
How do I get the budget approved inside the startup?
Attach the number to a business event rather than to a feeling. One external test of the product before a launch, because a critical finding found by a customer costs far more than the test. A retainer, because a 2 a.m. incident has no internal number to call. A compliance-shaped audit before a banking or enterprise customer asks for it. Write it into the hiring plan as well: budget for a security owner in the first engineering hire round, even if it is 20 per cent of one person's time, because a budget with no owner is a budget that quietly disappears. Review it quarterly against the actual spend, and move what is not being used.
| Line item | Amount | Why it is on the list |
|---|---|---|
| External VAPT of the product | Rs 75,000 | Independent evidence for launch and investor diligence |
| Identity and cloud hygiene | Rs 25,000 | Enforced MFA, IAM fixes, short-lived keys, 180-day logs |
| Email, endpoint and password licences | Rs 30,000 | Phishing is the most common first entry point in India |
| Incident-response retainer | Rs 15,000 a month | A named responder and a response time instead of a panic engagement |
What are the frequently asked questions?
Get a straight answer on this
Ask for our one-page first-year security budget template, with the four line items and the spend benchmarked against Indian startup stages.
Send us the details See pricing