Founders ask what they should spend on security and receive either a vendor quote or a lecture. Here is the version I give when nobody is selling anything: what buys the most risk reduction per rupee at each stage, and what is premature.
Pre-seed: ₹0
Before product-market fit, your security budget is discipline, not money. Secrets in a manager rather than a repository, multi-factor authentication on every admin account, dependency updates enabled, and no personal data collected that the product does not need. All free, all easier to establish now than to retrofit.
The one exception: if the product handles payments or health data from day one, move directly to the seed-stage list. Regulatory obligations under the DPDP Act do not wait for traction.
Seed: ₹50,000 – ₹1,00,000, spent once
- A threat-modelling workshop before you build the sensitive parts — the cheapest security intervention that exists.
- A focused code review of authentication, authorisation and payment paths once they exist.
- CI security gates: secret scanning, dependency scanning, one tuned SAST rule set.
What is premature at this stage: a full penetration test of a product still being rewritten monthly, a SOC 2 programme with no enterprise customer asking, and any security tool sold with an annual licence and a dashboard.
Series A: ₹1,50,000 – ₹4,00,000 a year
This is where security becomes a sales requirement rather than a risk decision. The first enterprise customer sends a questionnaire, and the deal stalls until you can answer it.
| Item | Indicative cost | Why now |
|---|---|---|
| Application penetration test + retest | ₹75,000 – ₹2,00,000 | The report enterprise buyers ask for |
| Cloud security assessment | ₹70,000 – ₹1,50,000 | Infrastructure has outgrown one admin key |
| Developer security training | ₹35,000 – ₹70,000 | Cheaper than repeating findings annually |
| Tooling (scanning, secrets, monitoring) | ₹30,000 – ₹1,00,000 | Coverage between manual tests |
What to say no to
- A ₹15,000 "VAPT certificate" — it is a scan export, and a knowledgeable buyer will notice.
- Compliance certification before a customer requires it by name.
- Any tool your team has no time to triage. An ignored alert queue is worse than no queue, because it looks like coverage.
The sequencing rule
Spend in this order: prevent by design, review the code, test the running system, then buy tools to hold the line. Reversing that order is how companies end up with three dashboards, a clean scorecard and an authorisation flaw that has been exploitable since launch.