TechD Cybersecurity: The Rise of India's Cyber-SME Underdog

I. Introduction & Episode Roadmap (00:00 – 05:00)

On the morning of September 22, 2025, a stock that almost nobody outside Gujarat had heard of a month earlier opened on the NSE Emerge platform at ₹366.70 — a 90% premium to its ₹193 issue price — and promptly locked into its upper circuit. The company was TechD Cybersecurity Limited, until weeks earlier a private firm called Techdefence Labs Solutions, operating out of a set of offices in Vastrapur, Ahmedabad.¹²

The listing pop was the least remarkable thing about it. The book had closed on September 17 with an overall subscription of roughly 718 times. Non-institutional investors bid 1,279 times their allotted portion. Individual investors bid 726 times. Even the qualified institutional buyers — the category that is supposed to bring discipline — bid 284 times.¹ For a ₹38.99 crore issue, that meant tens of thousands of crores of rupees chasing a slice of an Ahmedabad security auditing firm.

It is worth pausing on the arithmetic of that, because it tells you almost nothing about TechD and almost everything about the market. A 718x book on a ₹39 crore raise is not a referendum on discounted cash flows. It is a referendum on scarcity. When the float is tiny and the theme is hot, the clearing price of an allotment has very little to do with the clearing price of the underlying business.

And yet the business turned out to be real. In the fiscal year ended March 2026 — the first full year as a listed company — TechD reported revenue from operations of ₹51.8 crore, up about 74% year on year, and profit after tax of ₹14.04 crore, up roughly 68%.³ By July 28, 2026, the stock traded around ₹622, giving a market capitalisation of about ₹465 crore against a trailing price-earnings multiple near 33.⁴ Somewhere along the way, the 52-week range had run from ₹360 to ₹843.60 — a reminder that this is a micro-cap on an SME exchange, where liquidity and conviction are both thin.

Why cybersecurity, and why micro-caps. The 2024–2026 Indian SME listing boom was not indiscriminate. It had favourite themes, and cybersecurity sat close to the top for reasons that were partly sound and partly narrative.

The sound part: Indian enterprises were being compelled by regulators to spend on security on a fixed timetable, the domestic supplier base was fragmented and mostly unlisted, and the handful of listed pure-plays were small enough that plausible growth could compound into large returns. That is a legitimate setup, and it is why serious long-term investors were in these names alongside the momentum crowd.

The narrative part: "cybersecurity" is a theme that requires no operational understanding to feel bullish about. Everyone knows attacks are increasing. Almost nobody outside the industry can distinguish a company that sells compliance audits by the hour from one that sells software by the seat — a distinction that, as this story will show, accounts for a difference of nearly forty percentage points in net margin between two Indian firms of the same revenue size. When a theme is easy to believe and hard to evaluate, capital arrives faster than discernment does.

A correction to the founding legend before we start. TechD is often described in retail commentary as a tiny outfit that got lucky. It wasn't tiny. At the time of the offer document, the company employed 362 permanent staff and 223 contract personnel.⁵ It had been incorporated in January 2017.⁶ It held CERT-In empanelment and ISO 27001 certification.² The "garage startup" framing is the story the market told itself; the actual company was a mid-sized, people-heavy services firm with eight years of operating history and an unusually charismatic founder.

That founder — Sunny Piyushkumar Vaghela — is the second thing worth understanding, and the more complicated one. He is a man whose public biography has, for nearly two decades, been simultaneously a marketing asset and a subject of skepticism in the global security community. Both things are analytically relevant, and we will hold them together rather than resolving them prematurely.

Where this episode goes. We will trace four arcs. First, how a personal brand built on media-friendly hacking in the late 2000s converted into enterprise distribution — and why that conversion is both the company's real advantage and its most obvious single-point-of-failure. Second, how India's regulatory architecture — CERT-In empanelment, RBI's IT governance directions, SEBI's cyber resilience framework, and now the Digital Personal Data Protection regime — created a compliance-driven demand curve that a firm like TechD can ride without inventing anything. Third, the unit economics: what it actually costs to grow a business where the product is a person with a laptop, and whether the announced pivot to an "AI-native platform" changes that arithmetic or merely relabels it. And fourth, the capital-markets layer — the SME IPO structure, the Vijay Kedia halo, and the governance and disclosure questions that a skeptical investor would put to management if there were an earnings call to put them on. There isn't one, which is itself a finding.

Let's start where the story actually starts: with a teenager in Ahmedabad whose email got hacked.

↑ Back to Top

II. The Legend of the Ahmedabad Cyber Detective (05:00 – 15:00)

The origin story, as Vaghela has told it for the better part of two decades, begins with an indignity. As a schoolboy in the early 2000s, his personal email account was compromised. Rather than change his password and move on, he went looking for how it had been done — and fell into the world of phishing kits, session tokens, and the then-primitive plumbing of consumer internet authentication.

By 2004 he had enrolled at Nirma University in Ahmedabad to study Electronics and Communication Engineering, graduating in 2008.[^7] Those four years were, by his account, less about coursework than about a parallel career. He was in his late teens when Indian newspapers began describing him as a prodigy who had found holes in Orkut — then India's dominant social network — and in mobile network SMS handling, demonstrating that messages could be forged to appear to come from someone else.

To understand why this landed the way it did, you have to remember the moment. In 2007, India had roughly one internet-connected citizen for every twenty. Orkut was where the urban middle class lived online. The idea that a college student in Gujarat could reach into that system and demonstrate a flaw was, to a national press with almost no technical staff, irresistible. Vaghela became a recurring character: the young man in a formal shirt explaining cybercrime to television anchors.

What is striking, looking back across two decades of his public appearances, is how little the register has changed. Vaghela's public style has always been the same: formal, unhurried, more explainer than showman, speaking to a general audience about threats in the second person — your email, your company, your data. He does not perform technical superiority. That choice, whether calculated or temperamental, is exactly what made him useful to television producers in 2008 and exactly what makes him useful to a chief financial officer in 2026, and it is a rarer trait in the security industry than it sounds.

The pivot that mattered: from media to the state. Media fame is a depreciating asset. What made Vaghela's career durable was that he converted it into institutional relationships, and specifically into relationships with the Indian security apparatus. He served as a cybercrime investigation consultant to the Ahmedabad Crime Branch, and by his own account contributed to more than forty cases.[^7]

The engagement that anchors the legend is the July 26, 2008 Ahmedabad serial bombings. In the minutes before and after the blasts, threatening emails claiming responsibility were sent by the group calling itself Indian Mujahideen. Tracing them was not a matter of cracking encryption; it was a matter of following mail headers back to originating IP addresses and discovering that the senders had piggybacked on unsecured Wi-Fi routers in residential and commercial buildings. Vaghela has described his role in that trace as the defining case of his early career.[^7]

It is worth explaining, in plain terms, what that kind of trace involves — because the gap between how it sounds and what it is turns out to be the analytical point.

Every email carries a set of hidden routing headers, a postal history stamped by each server that handled it. Reading them tells you which internet connection the message was composed from. In 2008, tracing those headers back led investigators to residential and commercial buildings in Indian cities whose wireless routers had been left open — the attackers had simply parked outside, borrowed someone else's connection, and sent the message. There is no cryptography being broken in that story. There is a person who knows how to read a mail header and who is standing in a room where nobody else does.

That asymmetry — ordinary technical literacy meeting an institution that had none — is the real engine of Vaghela's early career, and it was the engine of a whole generation of Indian security consultancies. India's police forces and courts were, in the late 2000s, building digital investigative capability from close to zero. The private sector filled the gap. The people who filled it earned enormous credibility for work that a well-staffed forensics lab would have considered routine.

Here we have to be careful, because this is precisely where the record splits.

The skeptical stress test. For well over a decade, the security-industry watchdog site Attrition.org has maintained Vaghela on its "charlatan watch list." Its objections are specific and worth stating plainly rather than paraphrasing away. It argues that describing his early work as "ethical hacking" is a category error, because ethical hacking requires prior authorisation, not retroactive disclosure. It characterises the Orkut findings — session hijacking and cross-site scripting — as "pedestrian," noting that first-year practitioners routinely find such issues, sometimes with automated tools. It treats the claim of having traced the terror email trail with open sarcasm, implying it credits Indian law enforcement with less capability than it deserves. And it finds the sheer volume of claimed activity before age 22 — research, 140-plus workshops, certified training programmes, and a director-and-CTO role — "difficult to believe."⁷

An investor does not need to adjudicate that dispute to draw a useful conclusion from it. The relevant question is not whether a cross-site scripting bug in Orkut was technically impressive in 2007. It is whether the skill that built TechD was ever technical novelty in the first place. The evidence says it was not. What Vaghela demonstrably possessed — and what Attrition's critique, ironically, confirms — was an extraordinary ability to make security legible and urgent to non-technical decision-makers: newspaper editors, police commissioners, university deans, and eventually chief financial officers of Gujarati industrial groups.

That is a real and commercially valuable capability. It is also a different capability from building enterprise-grade systems architecture, and the gap between the two is the central tension of everything that follows. A firm that sells security audits to regulated enterprises does not need its founder to discover zero-days. It needs him to open doors, hold a CERT-In empanelment, and staff engagements with people who can execute. The bear case is not that the legend is exaggerated; it is that a legend does not scale, and the company has spent the last decade trying to build something that does.

The first attempt at that something was not a product. It was a classroom.

↑ Back to Top

III. From Classroom to Boardroom: The Foundations of Techdefence (15:00 – 27:00)

Picture a college auditorium in a tier-two Indian city around 2012. Four hundred engineering students, most of whom will graduate into a job market that wants them for maintenance work on other people's legacy code. On stage, a man barely older than they are is demonstrating, live, how to intercept a login session. He is not selling a product. He is selling a future in which what he just did is a career.

This was the HackTrack model, and it ran for years. Vaghela's professional profile records more than 650 workshops and over 80,000 students and professionals trained across universities and corporates.[^7]⁵ Whatever one makes of the precision of those counts, the structural logic is what matters, and it is genuinely clever.

Why a training business is a distribution business. Three things fell out of the seminar circuit, and only one of them was revenue.

The first was cash. Training is a beautiful little business: you collect fees before you deliver, your marginal cost is a trainer's day and a projector, and you carry almost no working capital. In an Indian services firm with no venture backing, that cash flow is what pays salaries in the months when a large client's payment is late. It funded the early corporate operation without dilution.

The second was recruitment. Every workshop was a live audition. When you have watched four hundred students attempt the same lab exercise, you know which six to hire — and you know it before any competitor has seen their résumé. For a business whose only real input cost is skilled labour in a chronically undersupplied market, a proprietary, pre-screened, pre-trained talent funnel is worth more than most patents.

The third was legitimacy laundering, in the neutral sense. A university that invites you to teach its students has implicitly vouched for you. Deans talk to trustees; trustees sit on the boards of local companies. In a business culture where trust travels through personal networks rather than analyst reports, the campus circuit was a referral engine dressed up as public service.

Incorporation, and the shift to selling audits. Techdefence Labs Solutions Private Limited was incorporated in January 2017 in Ahmedabad.⁶ The move from seminars to corporate engagements meant a different product entirely: Vulnerability Assessment and Penetration Testing — VAPT — plus compliance consulting, digital forensics, and eventually managed security services.²

For readers who don't live in this world, the plain-English version: VAPT is a fire inspection for software. You hire a firm to attack your systems the way a criminal would, and they hand you a report listing every unlocked window, ranked by how likely a burglar is to use it. It is a project — you buy it once, or once a year because a regulator says so. Managed security services, by contrast, are a fire brigade on retainer: the provider watches your systems around the clock and responds when something trips. The first is lumpy and transactional. The second is an annuity. Almost everything strategic about TechD over the last three years has been an attempt to move revenue from the first bucket to the second.

There is a puzzle buried in the chronology, and it is worth sitting with. Vaghela had national name recognition by 2009. The corporate entity that eventually listed was not incorporated until January 2017 — roughly eight years later. What happened in between was the slow, unglamorous business of learning that fame and a services company are different assets.

A seminar business is easy to start and impossible to scale beyond the founder's calendar. Every workshop needs a headliner, and the headliner is one person. Converting that into a firm meant hiring people who could deliver work the founder had never personally touched, building the documentation and quality processes that enterprise buyers audit before they sign, and — critically — accepting the vastly less exciting revenue model of selling recurring compliance work to procurement departments rather than dazzling auditoriums. Plenty of Indian security personalities from that era never made the transition and are still, twenty years on, doing paid speaking. The interesting fact about TechD is not that Vaghela became famous. It is that he stopped monetising fame directly and built an operating company underneath it.

The anchor-tenant trap. The early client list reads like a directory of Gujarat's industrial establishment: the Adani Group, Astral Limited, alongside Zensar Technologies and Kedia Capital.² These were exactly the right customers to win first. A conglomerate has dozens of subsidiaries, each of which needs its own audits — so one relationship compounds into many purchase orders. And a marquee logo is the single most effective sales tool in enterprise services, because the buyer's real question is never "is this product good?" but "will I be blamed if this goes wrong?"

The trap is on the other side of that ledger. Concentration in a handful of relationships within one region is a fragile revenue base. The offer document was explicit that revenue is heavily concentrated in Gujarat and Maharashtra, and that disruption in those states would materially affect results.⁵ Brokerage commentary at the time of the issue noted that the top ten clients accounted for roughly half of FY25 revenues.²

That is the position the company was in when it decided to go public: a profitable, founder-led, regionally concentrated services firm with a good brand in one state and almost none outside it. What it had that its thousands of unorganised competitors did not was a piece of paper from the Government of India.

↑ Back to Top

IV. The Gold Standard of Distribution: CERT-In Empanelment (27:00 – 40:00)

There is a particular kind of moat that exists only where the state decides who is allowed to sell. India's cybersecurity audit market is one of them, and the gate is called CERT-In.

The Indian Computer Emergency Response Team sits under the Ministry of Electronics and Information Technology, and among its functions is maintaining a list of organisations technically vetted to perform information-security audits for Indian regulated entities.⁸ Roughly two hundred firms sit on that empanelled list across its categories.⁹ Two hundred sounds like a lot until you consider the denominator: India has tens of thousands of IT services shops, and any of them can claim to do security work. Only the empanelled ones can do the work that matters.

Why the list is the business. Follow the money. The Reserve Bank of India's Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, issued November 7, 2023, obliges regulated financial entities to maintain formal IT governance and independent assurance over their information systems.¹⁰ SEBI's Cybersecurity and Cyber Resilience Framework, issued August 20, 2024, extends comparable obligations across the securities market ecosystem — exchanges, depositories, intermediaries, and the long tail of registered entities.¹¹ Government departments and public sector undertakings have their own audit mandates. In practice, all of these funnel toward auditors the state has blessed.

So the empanelment does something unusual: it converts a regulatory compliance cost for the customer into a demand floor for the supplier. A bank does not buy a penetration test because it woke up worried about attackers. It buys one because its regulator requires evidence, on a schedule, from an approved party. That demand is non-discretionary, recurring, and largely indifferent to the economic cycle — which is a very different revenue quality from selling software to a CIO with a budget she can defer.

What getting on the list actually costs. The empanelment is not a form you file. Applicants are assessed on the technical competence of named auditors, the methodology and tooling they use, evidence of completed engagements, and their own internal security posture — the auditor, reasonably enough, is expected to be secure. The list is maintained as a live document, refreshed whenever a firm is added, renewed, suspended or removed, and empanelment runs on fixed cycles that must be re-earned rather than assumed.⁹

That last detail is the one investors should internalise. Empanelment is a recurring obligation, not a permanent asset. A firm that loses key auditors, fails a renewal assessment, or suffers a breach of its own systems can find itself outside the gate — and a security company that loses its licence to audit regulated entities does not have a bad quarter, it has an existential problem. This is the single largest tail risk in the business model, and it is not one that shows up in any financial ratio.

TechD's empanelment has been renewed through 2028, and the company added a SOC 2 Type 2 certification during the first half of FY26 — the latter being the credential North American buyers ask for, which tells you where management was aiming.¹² It is also ISO/IEC 27001:2022 certified.¹³

Applying Hamilton Helmer's 7 Powers. Helmer's framework asks a disciplined question: what is the specific mechanism that lets this firm sustain differential returns against a determined competitor? Run TechD through it honestly and the answer is mixed.

Switching costs — genuinely high, but only for part of the revenue. Once a bank's security operations centre feed, its incident runbooks, and its compliance artefacts are wired through one provider, replacing that provider means re-onboarding under regulatory scrutiny, re-establishing baselines, and accepting a blind spot during transition. No compliance officer volunteers for that. But note the qualifier: this applies to managed services, not to one-off audits. A VAPT engagement can be re-tendered next year at a lower price by any of two hundred rivals. The strength of TechD's switching-cost power is therefore a direct function of how much of its revenue is annuity rather than project — which is precisely why the managed-services mix is one of the metrics worth tracking.

Cornered resource — real, but personal and therefore fragile. Vaghela's standing with Gujarati industrial families, Indian law enforcement, and the state's university system is not replicable by a competitor with more capital. It is also not transferable, not durable beyond his tenure, and not an asset the company owns. Investors should treat founder-embodied cornered resources as leases, not freeholds.

Scale economies — weak, and this is the crux. The empanelment is a barrier to entry, not a barrier to competition among those already inside. Once you are on the list, you compete on price and delivery capacity like any other consultancy. And a consultancy's cost base scales roughly with revenue, because the unit of production is a trained human being. There is no meaningful fixed-cost leverage in a penetration test.

Counter-positioning, network economies, branding, process power — largely absent. There is no incumbent that cannot copy TechD's model; there is no effect by which each additional customer makes the service better for the next; the brand is regionally strong and nationally modest; and there is no proprietary process embedded over decades.

The honest conclusion: CERT-In empanelment gives TechD a licence to compete for high-quality, regulation-driven revenue that most Indian IT firms cannot touch. It does not, by itself, give the company pricing power against the roughly two hundred peers holding the same licence. The moat is around the industry, not around the company. Anyone underwriting this stock on "regulatory moat" alone is underwriting the wrong thing.

What the empanelment did do, spectacularly, was make TechD legible to public-market investors at exactly the moment those investors were desperate for a cybersecurity story to buy.

↑ Back to Top

V. The SME IPO Frenzy & The Kingmaker's Entry (40:00 – 55:00)

To understand September 2025, you have to understand what the Indian small-cap market had become by then — and what the regulators had just done about it.

NSE Emerge and its BSE counterpart were designed as on-ramps: platforms where small companies could raise modest sums under lighter disclosure than the main board, with the intent that successful ones would eventually migrate up.[^15] By 2024 they had become something else. Retail investors, priced out of the main-board allotment lottery, discovered that SME issues were smaller, more thinly analysed, and — because of the way allotments worked — capable of producing enormous first-day returns. Issue after issue closed at triple-digit subscription multiples on businesses few could describe.

Regulators noticed. Effective July 1, 2025 — ten weeks before TechD's book opened — NSE and BSE raised the minimum application size for SME IPOs to ₹2 lakh across all investor categories, replaced the "retail individual investor" category with a broader "individual investor" category requiring a minimum of two lots, eliminated cut-off price bidding, and barred bid modification or cancellation.¹⁴ The stated intent was to filter out speculative participation and push the segment toward investors with genuine risk tolerance.

The result, at least in TechD's case, was not what the framers might have hoped. Raising the ticket size to ₹2 lakh did not reduce demand; it concentrated it among wealthier applicants. A 718x book after the tightening is a more striking datapoint than a 718x book before it would have been.

The mechanics of the offer. The issue was 100% fresh — 20,20,200 equity shares of ₹10 face value, priced in a band of ₹183 to ₹193 and struck at the top, raising ₹38.99 crore. There was no offer for sale, meaning no promoter took money off the table; every rupee went to the company. Promoter holding moved from 87.00% pre-issue to roughly 63.2% after.⁶ The book was managed by GYR Capital Advisors, with Purva Sharegistry as registrar and Giriraj Stock Broking as market maker.²¹⁵

The absence of an offer-for-sale component deserves a moment. In a segment where promoter cash-outs at inflated valuations have been a recurring investor grievance, a pure primary raise is the structurally cleaner choice. It does not prove management's intentions were good, but it removes the most common way SME promoters have extracted value from public shareholders.

Ahead of the book, the company placed 5,74,800 shares with three anchor investors at ₹193, raising ₹11.09 crore.¹⁵ The grey market premium ran at roughly ₹160 per share going into the issue — implying an expected listing gain around 83%, which turned out to be a slight underestimate.¹⁵ Brokerage notes were mostly positive; notably, Dalal & Broacha flagged concerns about receivables while still suggesting participation "primarily for potential listing gains" — a phrasing that says a great deal about how the sell side understood the trade.¹⁵

The arithmetic of scarcity. It is worth walking through why a 718x book is a statement about supply rather than about value, because the same dynamic recurs in every hot SME issue and mislead investors every time.

Strip out the anchor allocation and the market maker's shares, and the genuinely available public portion of this offer was small — a few hundred crore rupees' worth of demand chasing perhaps a dozen crore rupees of shares in some categories. Applicants know this. The rational response to a lottery with a large expected prize and a tiny probability of winning is to buy more tickets, which is exactly what a bid multiple measures. Under the post-July rules, each ticket cost at least ₹2 lakh, so a 1,279x non-institutional book represents fewer applicants deploying larger sums than the raw multiple suggests.

None of that arithmetic contains information about whether ₹193 was a sensible price for a share of the business. It contains information about how many people wanted a shot at the listing pop. The two questions were answered by completely different processes, and conflating them is the most common error investors make in this segment.

The Kedia effect. The single most powerful marketing asset in the offer was not the CERT-In empanelment. It was a name on the pre-IPO shareholder register.

Vijay Kishanlal Kedia held 3,93,100 equity shares before the issue, a 7.20% stake, which diluted to roughly 5.3% post-listing.¹⁵ Kedia is among the small handful of Indian individual investors whose portfolio disclosures move prices on their own, and by 2025 he had assembled an explicit thematic position in Indian cybersecurity — TAC Infosec and Sattrix Information Security alongside TechD.

The thesis behind that basket is coherent and worth stating on its own terms: India is building digital public infrastructure at enormous scale, its regulators are mandating security spending faster than its enterprises are staffing for it, and the resulting compliance demand must be met by domestic providers because of data-sovereignty considerations. If you believe that, you want exposure to the empanelled Indian suppliers, and you want it early while they are still micro-caps.

But investors should be clear-eyed about the mechanism by which a Kedia stake creates value. Some of it is genuine: a sophisticated investor did diligence and concluded the business was worth owning, and his continued presence on the register is an ongoing signal. Some of it is reflexive: retail participants buy because he owns it, the price rises, the rising price attracts more buyers, and the "validation" becomes self-referential. In a stock with a free float of roughly a third of a ₹465 crore company, that second mechanism can dominate the first for long stretches.

TechD listed at ₹366.70 on September 22, 2025 and closed the day at its 5% upper circuit.¹² Over the following ten months, the price roughly doubled again from the listing level to around ₹622 by late July 2026, having touched ₹843.60 along the way.⁴ That path — a 90% listing pop, a further double, and a 30% drawdown from the high — is a fairly typical SME price signature. It tells you about float and flows. To learn anything about the business, you have to look at what the company actually did with the money and the year.

↑ Back to Top

VI. Financial Deep Dive: Deconstructing the Services-Heavy Engine (55:00 – 72:00)

Strip away the listing and the story becomes simpler, and in some ways more impressive. This is a company that has roughly doubled revenue every year for four consecutive years.

Operating revenue went from ₹7.56 crore in FY23 to ₹15.07 crore in FY24 to ₹29.80 crore in FY25.¹⁶ Profit after tax over the same stretch moved from ₹0.94 crore to ₹3.24 crore to ₹8.40 crore.¹⁶⁶ Then FY26, the first year with listed-company money and a listed-company profile: revenue from operations of ₹51.8 crore, up 73.88%, and PAT of ₹14.04 crore, up 67.61%.³

What the growth actually says. Sustained doubling in a services business is not a demand story alone; it is a hiring story. You cannot deliver twice the audits without close to twice the auditors, unless price or utilisation moves sharply. So the FY26 result is primarily evidence that management could recruit, train, and deploy people at speed without the delivery quality collapsing — which, in a market where every empanelled competitor is fishing in the same talent pool, is a genuine operational achievement rather than a market-beta outcome.

It is also evidence of something less flattering: the growth was extraordinarily back-loaded. Revenue in the second half of FY26 was ₹33.62 crore, roughly 85% higher than the first half.³ Second-half weighting is normal in Indian enterprise services — government and PSU budgets close in March, and clients rush to consume allocated spend — but an 85% half-on-half swing is at the extreme end. It concentrates a large share of the year's revenue recognition into a period when auditors have the least time to scrutinise it, and it makes any single delayed or accelerated contract disproportionately material to the reported annual number.

Margins, and a reconciliation worth doing yourself. The company reported FY26 EBITDA of ₹20.16 crore, an EBITDA margin of 37.85% and a net profit margin of 26.36%.³¹⁷ Two observations follow.

First, the reported margins appear to be computed on total income (roughly ₹53 crore including other income) rather than on revenue from operations. On operating revenue of ₹51.8 crore, the same EBITDA works out closer to 39%. This is not deception — plenty of companies present it this way — but it means peer comparisons drawn from headline margin figures are not apples to apples.

Second, and more substantively: the release described EBITDA as growing 83.66% year on year. Against the FY25 EBITDA of ₹12.24 crore disclosed in the IPO materials, ₹20.16 crore is growth of about 65%, not 84%.¹⁶ The gap implies a different base — restatement, consolidation of the new subsidiaries, or a reclassification. That is a reasonable thing to happen and an unreasonable thing to leave unexplained. An investor should reconcile it against the audited annual report rather than accept the press-release growth rate.

There is a related line item worth flagging. Employee benefit expenses for FY26 were reported at ₹9.36 crore, down from roughly ₹12 crore in FY25 — in a year when revenue grew 74% and the stated primary use of IPO proceeds was hiring.¹⁷ The most likely explanation is a reclassification of delivery staff costs into cost of services or a shift toward subcontracted and channel-partner delivery. Both are legitimate. But an investor cannot assess operating leverage without knowing which, because the two have very different implications: internal capacity building versus outsourced margin arbitrage. This is the single most important disclosure question in the FY26 numbers, and it is not answered anywhere in the public materials.

Where the money comes from. TechD does not publish audited segment-level revenue. Publicly it describes a services core — managed security services, VAPT, compliance, digital forensics, specialised services and staff augmentation — alongside a training and certification arm delivered in partnership with universities.⁵² Commentary circulating around the listing put the split at roughly 84% services and 16% training, but that figure does not appear in the company's own disclosures and should be treated as an estimate rather than a fact.

What is disclosed about the training arm is strategic rather than financial, and it is the more interesting part. In November 2025 the company secured affiliation with Kaushalya The Skill University in Gujarat to launch the Techdefence Labs Skill Development Institute, offering five 120-hour government-recognised certification tracks — VAPT, governance and compliance, SOC analyst, digital forensics and incident response, and cloud security — with a stated target of 10,000-plus students over two years.¹⁸ It runs longer-form degree tracks with institutions including Parul University and Silver Oak University.

Read that as a labour-supply strategy, not a revenue line. Indian security engineers in Bengaluru and the National Capital Region command wages set by global demand. An Ahmedabad firm that trains its own SOC analysts from Gujarat's engineering colleges is manufacturing its input rather than buying it at market price. If it works, it is a structural cost advantage that compounds. The evidence it is working is indirect but real: the company reported a customer renewal rate above 90% and a net promoter score of 95.6% in the first half of FY26 — numbers that would be difficult to sustain with a revolving door of undertrained juniors.¹² Both, it should be noted, are self-reported and unaudited.

Counting customers, and what the count implies. The most useful non-financial disclosure the company has made concerns logos. Management reported roughly 500 client organisations at the half-year mark of FY26, having added 90 new enterprise customers in that period; more than 730 logos by the close of FY26; and over 140 new entities onboarded in the first two months of FY27 alone.¹²¹⁷ Public materials in July 2026 described the base as 800-plus enterprise clients.¹³

Two conclusions follow, pulling in opposite directions.

The encouraging one: at 730-plus customers on ₹51.8 crore of revenue, average revenue per client is roughly ₹7 lakh — a small ticket. A business selling small tickets to hundreds of buyers is far less fragile than the top-ten-at-half-of-revenue picture from FY25 suggested, and the trajectory implies concentration has been diluting quickly. If the mix continues to broaden, the single loudest item in the bear case gets quieter.

The cautionary one: adding 140 logos in two months is a velocity that implies a substantial share of low-value, possibly single-engagement customers — the kind acquired through channel partners and system integrators rather than through direct relationships. Several of the July 2026 order announcements were explicitly routed through a listed cybersecurity system integrator acting as distribution partner.¹³ Channel-led acquisition is a legitimate and capital-efficient way to scale reach, but the customer belongs to the channel, the margin is shared, and the switching costs that make managed services valuable never form. Logo count alone cannot distinguish a broadening franchise from a lengthening tail.

The cash quality question. Operating cash flow in FY26 was ₹8.55 crore, against PAT of ₹14.04 crore — roughly 61% conversion. That is a marked improvement on FY25, when operating cash flow was just ₹0.95 crore against ₹8.40 crore of profit, or barely 11%.¹⁷ The direction is unambiguously good. The level still says that a substantial share of reported profit sits in receivables rather than in the bank, which is exactly the concern the sell side flagged before the issue. In a business selling to conglomerates, PSUs and government departments — buyers with long payment cycles and no urgency — that is structural, not aberrant. It is also the reason a debt-free balance sheet matters more here than it would elsewhere: the company reported net worth of ₹71.82 crore post-IPO and no debt, which is the buffer that lets it fund a growing receivables book without a working-capital line.¹⁷

Growth of this shape raises an obvious question: what does the company become at three times the size? Management's answer, delivered over the past year, has been that it becomes a platform. Its closest listed peer has been making that claim for longer, and the market has been pricing the difference.

↑ Back to Top

VII. Competitive Benchmarking: TechD vs. TAC Security vs. Sattrix (72:00 – 88:00)

Three Indian cybersecurity companies listed on SME platforms during the 2024–2026 wave. All three attracted Vijay Kedia. All three are roughly the same size by revenue. And they are, economically, three entirely different businesses — which makes them one of the cleanest natural experiments available in Indian small caps.

TAC InfoSec is the platform case. In FY26 it reported revenue from operations of ₹57.26 crore, up 88%, with EBITDA of ₹30.75 crore at a 53.8% margin and PAT of ₹26.35 crore at a 46.1% margin.¹⁹ Founder Trishneet Arora framed the year as proof that TAC "is not only growing fast, but growing profitably and globally," citing a customer base scaling toward 10,000-plus across more than 100 countries.¹⁹ Its core is ESOF — Enterprise Security in One Framework — a vulnerability management and cyber-risk platform sold as software.

Sattrix Information Security is the volume-services case. FY26 standalone revenue was ₹58.76 crore, up about 34%, with PAT of ₹8.83 crore, roughly doubling year on year, and standalone EBITDA of ₹14.12 crore at a 24% margin.²⁰²¹ Its return profile is the tell: ROE of 7.4% and ROCE of 10.4%, against debtor days of 244 — nearly eight months of sales sitting in receivables.²¹

TechD sits between them: mid-thirties EBITDA margin, mid-twenties net margin, and — on the FY25 pre-IPO capital base — returns that were extraordinary, with ROE of 62.33% and ROCE of 54.25% disclosed in the offer materials.¹⁶ Post-IPO, with ₹39 crore of fresh equity on the balance sheet, trailing ROE has compressed to about 29.9% and ROCE to 40.9%.⁴ That compression is arithmetic, not deterioration — you cannot raise equity and hold return on equity constant — but anyone still quoting the 62% figure is quoting a company that no longer exists.

What the comparison actually demonstrates. Line the three up and the pattern is stark. Nearly identical revenue; PAT ranging from ₹8.8 crore to ₹26.4 crore. The difference is not execution quality. It is what the marginal rupee of revenue costs to deliver.

TAC's marginal customer consumes some cloud compute and a support ticket. Sattrix's marginal customer consumes engineers, integration hours, and — given those debtor days — a large slug of working capital. TechD's marginal customer consumes engineers too, but fewer of them per rupee, because it has been deliberately shifting toward managed services and higher-value compliance work rather than bidding for volume integration.

The market prices this difference and prices it aggressively. As of late July 2026, TechD traded around ₹465 crore market capitalisation at roughly 33 times trailing earnings.⁴ Sattrix traded at about ₹417 crore on 47 times, despite earning less than two-thirds of TechD's profit — a multiple that reflects growth acceleration and possibly float scarcity more than returns on capital.²¹ TAC's valuation has been the most volatile of the three, with reported market capitalisation swinging from roughly ₹1,183 crore in April 2026 to about ₹876 crore in July 2026 — a 26% derating inside a quarter on no obvious change in fundamentals.

That volatility is the honest coda to any peer table in this segment. Multiples on SME-platform micro-caps are not stable measures of relative quality; they are measures of who is buying that week.

The rebranding question. Which brings us to the most consequential strategic question facing TechD: whether it can migrate toward the platform economics that command TAC's premium, or whether the attempt is narrative repositioning.

The evidence, as of mid-2026, is genuinely mixed and should be presented that way.

On May 22, 2026, the company launched TECHD ONE, described as an AI-native unified cybersecurity platform, and relaunched its digital presence from techdefencelabs.com to techdefence.ai.²²³ Four modules were presented as production-ready: Dark Vector AI for external attack surface management and dark-web threat intelligence; Provenance AI for supply chain security, source code review and software bill-of-materials work; Human Trust AI for behavioural risk covering phishing, vishing and insider threat; and OT Shield AI for operational technology and industrial infrastructure. A second phase — SecOps AI, PrivacyOps AI, and Identity Guard — was slated for 2027.²² Vaghela's framing was pointed: "For two decades, Indian enterprises have bought point products that don't talk to each other. TECHD ONE rewrites that contract. It is a single AI-native platform, built on indigenous models."²²

There is real substance underneath the marketing. The company disclosed SOC capacity processing more than 20,000 events per second across 160-plus customers.¹⁷ Automated correlation at that volume is not optional; no human team reads 20,000 events a second. So the automation is operationally necessary and almost certainly real.

But "necessary automation inside a services delivery centre" and "software product with software margins" are different businesses, and the public evidence does not yet distinguish them. TechD has not disclosed platform-attributable revenue, licence or subscription bookings, per-seat or per-module pricing, or gross margin by delivery mode. Until it does, the platform claim cannot be tested — and the burden of proof sits with management, not with the skeptic. A domain migration to a .ai address is a marketing decision. A change in the ratio of revenue to headcount is a business model change. Only the second one shows up in the accounts.

Myth versus reality. Four consensus narratives have attached themselves to this stock. Each contains something true and something that does not survive contact with the disclosures.

Myth: TechD is a scrappy startup that came out of nowhere. Reality: it was an eight-year-old firm with 362 permanent and 223 contract staff, CERT-In empanelment, and a client roster including one of India's largest conglomerates at the time of its offer document.⁵² The "nowhere" it came from was Ahmedabad, which is not the same as nowhere. The novelty was to public investors, not to the market it served.

Myth: CERT-In empanelment is TechD's moat. Reality: it is the industry's moat, shared with roughly two hundred firms.⁹ It determines which pool the company swims in, not whether it wins races within that pool. The differentiators inside the pool are delivery capacity, sector specialisation, and relationships — none of which are conferred by the certificate.

Myth: the 62% return on equity proves an exceptional business. Reality: that figure described a company operating on ₹18 crore of net worth before it raised ₹39 crore. Post-issue trailing returns near 30% remain very good, but the headline number circulating in retail commentary belongs to a prior capital structure.¹⁶⁴ High ROE in a services firm is substantially a statement about how little capital the model requires — which is also the reason competitors need so little capital to enter.

Myth: the .ai rebrand marks a transition to software. Reality: the platform launch is real, the modules are described in specific and plausible terms, and the automation underlying a 20,000-events-per-second SOC is certainly genuine.²²¹⁷ What has not been disclosed is a single rupee of platform-attributable revenue, any licence or subscription metric, or a gross margin by delivery mode. Two-thirds of the IPO proceeds were earmarked for hiring people.¹⁶ On the company's own capital plan, this is still a services business that has built good tooling.

The place to look for the answer is in how the company has spent its IPO money.

↑ Back to Top

VIII. Capital Allocation & The Expansion Strategy (88:00 – 100:00)

₹38.99 crore is not much capital. For a company that generated ₹51.8 crore of revenue in the following year, it is roughly nine months of turnover. How it gets spent is therefore a reasonably pure signal of what management actually believes, unclouded by the option of doing everything at once.

The offer document allocated the proceeds three ways: ₹26.09 crore — about 66.9% of the issue — to investment in human resources, explicitly including expansion of teams targeting North America, the Middle East and Southeast Asia; ₹5.89 crore, roughly 15.1%, to establishing a Global Security Operations Centre in Ahmedabad; and the balance to general corporate purposes.¹⁶

Read the allocation as a confession. Two-thirds of the raise went into people. Whatever the platform narrative says, management's own capital plan describes a business that grows by hiring. That is not a criticism — it is the correct plan for the business as it exists — but it is the most direct available rebuttal to the idea that TechD had already become a software company by the time it listed. The stated plan and the stated narrative point in different directions, and investors should weight the plan.

The GSOC, and why it is the important 15%. The smaller allocation is the strategically heavier one. A Global Security Operations Centre is shared infrastructure: one facility, one tooling stack, one roster of analysts on rotating shifts, monitoring many clients simultaneously. Its economics are the closest thing a services firm gets to operating leverage. The first client pays for the building; the fiftieth client mostly pays for a fraction of an analyst's attention. It also converts revenue from project-shaped to annuity-shaped, because monitoring is sold as a multi-year retainer rather than an annual audit.

By the first half of FY26 the project had been branded "TechD Cyber Valley," with Vaghela describing it as something that "will revolutionise our managed security services" and positioning it as the hinge in TechD's evolution "from a national leader into a truly global cybersecurity powerhouse."¹² By May 2026 the disclosed scope had grown considerably: a 60,000 square foot global capability centre in Ahmedabad, with operations targeted to begin in September 2026.¹⁷

That scope expansion is worth watching rather than celebrating. A ₹5.89 crore budget line and a 60,000 square foot facility are not obviously the same project. Either the company is funding the larger version from operating cash flow — plausible, given ₹8.55 crore of operating cash and a debt-free balance sheet — or the scope has outrun the plan. The FY27 disclosures should reconcile the two, and if they don't, that is a finding in itself.

Going international, three ways. During FY26 the company incorporated wholly owned subsidiaries in Canada and at GIFT City IFSC, with Dubai also cited as an operating base.¹⁷²³

The Canadian entity — TECHDEFENCE CYBERSECURITY INC. — is positioned as the North American delivery and innovation hub.²³ The strategic logic is straightforward: Indian delivery cost, North American pricing. The execution risk is equally straightforward and is the graveyard of many Indian IT services expansions. North American enterprise security sales cycles are long, the buyer expects local presence and local references, and customer acquisition cost per contract can be several multiples of the Indian equivalent. A firm whose distribution advantage is a founder's personal network in Gujarat has, by definition, none of that advantage in Toronto. The SOC 2 Type 2 certification obtained during FY26 removes one procurement obstacle; it does not create demand.¹²

The GIFT City subsidiary is the more elegant move. India's International Financial Services Centre lets a domestic company serve international financial clients under an offshore regulatory and tax regime without establishing foreign operations. For a firm whose deepest expertise is financial-sector compliance under RBI, SEBI and IFSCA regimes, it is a way to sell an existing capability to a new customer set at low incremental cost. The company disclosed serving more than 545 regulated financial entities across those three regulators, with a stated ambition of exceeding 1,000 by the end of FY27.¹⁷

Early international traction has been visible in the order flow. Overseas revenue rose to 21% of first-half FY26 revenues from about 15% in the prior year.¹² In July 2026 the company announced a cluster of mandates from Indian and UAE clients totalling roughly ₹3.93 crore across renewable energy, aviation, shipping, telecom, financial services, FMCG, government, media and education technology — including named wins at Mundra Solar PV (Adani Group) and Jaipur International Airport.²⁴¹³ Vaghela's commentary emphasised "growing demand from enterprises looking for integrated cybersecurity solutions that deliver continuous protection" — language that maps to the annuity strategy rather than to project work.²⁴

A structural complexity worth watching. In the space of one year, a company with roughly ₹52 crore of revenue went from a single operating entity to a group with subsidiaries in Canada, a GIFT City IFSC vehicle, and a Dubai presence — with an Australian acquisition potentially adding a fourth jurisdiction.¹⁷²³

An activist investor would put three questions to that structure, and none of them is hostile. First, how is revenue recognised and transfer-priced between the Indian parent and the offshore entities, given that delivery will overwhelmingly happen in Ahmedabad while contracting happens abroad? The answer determines where profit lands and how comparable the consolidated margin is to the standalone history investors have been tracking. Second, what does the consolidation do to the reported growth rates — because a group that adds entities mid-year produces year-on-year comparisons that are not like-for-like, which may be part of what is already visible in the FY26 EBITDA base discrepancy. Third, does the multi-entity structure create related-party flows between group companies, and are they disclosed at a granularity a minority shareholder can assess?

None of this suggests anything improper. It suggests that the accounting is about to get more complicated than the disclosure regime requires the company to explain, and that the FY27 consolidated statements will be considerably more informative than the FY26 press releases were.

The capital discipline claim, and its immediate test. TechD's management has consistently presented itself as organically minded and non-leveraged: no debt, no acquisitions, greenfield expansion only. On the evidence through FY26, that is accurate.

It is also, as of the FY26 disclosures, no longer the whole plan. Management indicated that an Australian managed-security-services acquisition was in final stages, with projected revenue around $4.5 million — roughly ₹30 crore if completed.¹⁷ Set against FY27 organic revenue guidance of ₹75 to ₹80 crore, that would be a transformational deal: nearly 40% of the organic base, bought in a market where the company has no operating history, using a balance sheet with ₹71.82 crore of net worth.¹⁷

This is precisely the moment where capital allocation records are made or broken. Cross-border services acquisitions are notoriously difficult — the asset is the client relationships and the delivery staff, and both can walk. An investor who has been told to expect organic discipline is entitled to ask what changed, what the purchase price and funding structure are, what retention arrangements bind the acquired leadership, and how the target's margin profile compares. None of that had been disclosed as of late July 2026. The deal may well prove sensible. The disclosure standard around it will tell you as much about management as the deal itself.

↑ Back to Top

IX. The Investment-Story Spine: Why Win / Why Not (100:00 – 112:00)

Every investment case reduces to one question: what specifically has to be true for this to work, and what would prove it isn't? Here is that spine for TechD, tested rather than asserted.

The case for winning

One: the demand curve is written into law, not into a sales forecast. This is the strongest leg. RBI's IT governance directions, SEBI's cyber resilience framework, and the Digital Personal Data Protection Rules notified in November 2025 — which give organisations an eighteen-month transition running to May 13, 2027 — collectively create a wave of mandatory compliance work with a deadline attached.¹⁰¹¹²⁵ Deadlines are the best thing that can happen to a compliance auditor: they compress demand into a defined window and remove price sensitivity, because the alternative to paying is regulatory exposure. TechD sits inside the empanelled set that can service that demand.

Two: capital efficiency is exceptional, and that is not an accident. Even after IPO dilution, trailing returns near 30% ROE and 41% ROCE on a debt-free balance sheet describe a business that converts very little capital into a lot of profit.⁴ The mechanism is that services businesses need almost no fixed assets — the asset walks out of the building each evening. The corollary is that the same lack of capital intensity means nothing stops a competitor from doing the same thing.

Three: the talent pipeline is a genuine, if slow-compounding, structural edge. Manufacturing your own analysts through university affiliations in a low-wage-inflation geography, and retaining them at above-90% client renewal rates, is a cost position that Bengaluru-based competitors cannot easily replicate.¹²¹⁸ It is the one advantage in this business that gets stronger with time rather than weaker.

The case against

One: client and geographic concentration remain unresolved. Top-ten clients at roughly half of FY25 revenue, and revenue heavily concentrated in Gujarat and Maharashtra, are not theoretical risks.²⁵ The loss of a single conglomerate relationship — and conglomerates consolidate vendors regularly — would be visible in the annual number immediately. The international push is the mitigation, and it is one year old.

Two: the labour bottleneck is the whole bear case in one sentence. If TECHD ONE does not meaningfully decouple revenue from headcount, then growth requires proportional hiring, margins compress as the company competes for scarcer senior talent, and returns on capital drift toward Sattrix's rather than toward TAC's. The gap between a 46% net margin and a 9% net margin in the same industry is not a gap in ambition; it is a gap in business model.¹⁹²¹

Three: disclosure quality is thin, and that is a risk in its own right. As an SME-platform company, TechD reports half-yearly rather than quarterly, holds no earnings calls, and communicates primarily through press releases distributed via wire services — some of which carry sponsored-content disclaimers.¹⁷ There is no analyst Q&A on the record where management has been pressed on the employee-cost reclassification, the EBITDA base discrepancy, the receivables trajectory, or the Australian acquisition. Investors are being asked to underwrite a growth story with no adversarial testing of it. That is not an accusation of anything; it is a statement about the information environment, and it should widen the range of outcomes a reasonable investor attaches to the name.

Porter's Five Forces, applied to Indian cyber services

Threat of new entrants — moderate. CERT-In empanelment is a real barrier, but roughly two hundred firms have already cleared it, and the capital required to start a security consultancy is essentially a founder and a hiring budget.⁹

Bargaining power of buyers — high, and rising. TechD's customers are conglomerates, PSUs and banks — sophisticated procurement organisations that re-tender, that can play empanelled auditors against each other, and that pay slowly. The 244 debtor days at Sattrix show what happens when a supplier has no leverage in that relationship.²¹

Bargaining power of suppliers — high, where the supplier is labour. Trained security engineers are the scarce input, and their wages are set by a global market. This is the force that determines margin, and it is the one the university strategy is explicitly designed to blunt.

Threat of substitutes — real and accelerating. The substitute for a security consultant is not a different consultant; it is software. Automated scanning, cloud-native security tooling, and AI-assisted triage each compress the billable hours in a traditional engagement. TAC's economics are the proof that the substitute already works commercially.

Competitive rivalry — intense in commodity work, moderate in specialised work. VAPT is nearly a commodity among empanelled firms. Regulated-sector managed services with switching costs and OT security are not. TechD's margin depends on the mix drifting toward the second.

The risk radar that actually applies

Most macro risk checklists are noise for a company this size. Four exposures here are mechanically real.

Technology disruption, pointed directly at the revenue line. This is the unusual case where the disruptive technology and the company's own product pitch are the same thing. If AI-assisted security tooling makes a penetration test take a third as long, the market price of a penetration test falls accordingly — and TechD sells penetration tests. Management's answer is that it will be the one deploying the tooling and will capture the surplus. That is a plausible strategy and an unproven one, and the honest framing is that TechD is racing to disrupt its own billable hours before someone else does it for free.

Being the target. A security firm holds the vulnerability reports, network topologies and privileged access credentials of hundreds of client organisations, including regulated banks and government entities. That makes it a concentrated and attractive target, and a supply-chain vector into everyone it serves. A material breach at TechD would not be a reputational setback; it would jeopardise the empanelment, the client base and the regulatory standing simultaneously. No amount of financial analysis prices this risk, and it does not appear in any ratio.

Key personnel, in both directions. The founder-dependency has been discussed. The less obvious version runs the other way: a services firm's enterprise value walks out of the building every evening, and a competitor that lifts a senior delivery team takes the client relationships with it. Attrition among senior engineers is the operating risk that most directly threatens the order book, and the company does not disclose attrition rates.

Regulatory and political, in an unusual shape. The regulatory tailwind is also a regulatory dependency. If compliance deadlines slip — India has extended data protection timelines before — the demand that arrives on a schedule arrives later. And a firm whose early growth ran through relationships with state agencies and one politically prominent conglomerate carries a form of concentration that is not purely commercial. Neither is a present problem. Both are worth naming rather than assuming away.

Management credibility, assessed on behaviour

Alignment first: promoters held 63.24% as of June 2026, with no offer for sale at the IPO.⁴⁶ Vaghela's remuneration of ₹84 lakh against ₹14.04 crore of PAT is modest by SME standards, where founder pay routinely consumes a visible share of profit. On the two most common governance red flags in this segment — cashing out at listing and paying yourself the profits — TechD is clean.

On execution against stated targets, the record is short but positive. The company set out to build the GSOC and expand internationally; within a year it had incorporated the Canadian and GIFT City entities, obtained SOC 2 Type 2, renewed CERT-In empanelment through 2028, launched the platform, and delivered revenue growth roughly in line with what the offer materials implied, closing FY26 with a ₹43 crore order book.¹²¹⁷³ Guidance for FY27 of ₹75 to ₹80 crore organic is specific enough to be scored — which is more than many SME managements offer.¹⁷

The debits are equally concrete. There is a historical statutory compliance lapse: Vaghela was disqualified as a director under the Companies Act, subsequently regularised through a DIR-3 KYC filing on February 16, 2021 and a compounding application to the Registrar of Companies. It was disclosed in the offer document, which is the right thing to have done, and it appears to have been an administrative failure rather than a substantive one. But it is a data point about the pre-IPO compliance culture of an organisation that now answers to public shareholders. Then there is the unexplained EBITDA base, the falling employee cost line against surging revenue, and a stated commitment to organic growth alongside an unpriced cross-border acquisition. None of these individually is disqualifying. Collectively they describe a management team whose communication has not yet caught up with its operating performance.

The metrics that matter

Three, and only three, are worth tracking closely.

Revenue per employee. This is the single cleanest test of whether TECHD ONE is a business model or a website. If revenue grows faster than headcount over the next two years, the platform is real. If they grow in lockstep, TechD is a consultancy with good marketing — a perfectly respectable thing to be, but worth a consultancy's multiple.

Order book and the annuity mix. The ₹43 crore book disclosed at March 31, 2026 covers a meaningful share of the following year's organic guidance, and its composition matters more than its size.¹⁷ Rising multi-year managed-services contracts mean the switching-cost power is deepening. A book dominated by one-off audits means it isn't.

Cash conversion. Operating cash flow as a percentage of profit after tax. FY25 was 11%, FY26 was 61%.¹⁷ If that keeps climbing toward and through 80%, the reported profits are real and the receivables discipline has improved. If it stalls or reverses while revenue grows, the growth is being bought with the balance sheet.

↑ Back to Top

X. Playbook & Key Investing Lessons (112:00 – 120:00)

Three durable lessons come out of this story, and none of them is specific to cybersecurity.

Personal brand can substitute for capital, but only once. TechD reached scale without institutional funding because its founder had spent a decade converting media attention into training seminars, training seminars into recruitment and referrals, and referrals into enterprise contracts. That is a legitimate bootstrapping engine, and it explains how a company with no venture backing arrived at ₹30 crore of revenue and 62% returns on equity before ever meeting a public investor.¹⁶

The limit is structural. Founder-embodied distribution does not cross borders, does not survive the founder, and does not compound with scale — every new customer still requires the same personal credibility that the last one did. Every company built this way eventually faces the same transition, and the transition is the risk. TechD is inside it right now: the Canadian subsidiary, the GIFT City entity, and the platform launch are all, in different ways, attempts to build distribution that does not route through one person. Investors should watch whether large contracts increasingly close without the founder in the room. That is the migration that matters, and it is observable if you look at who signs the announcements.

There is a broader version of this lesson for anyone evaluating founder-led businesses in emerging markets. In economies where formal credit is expensive, credentialing institutions are weak, and enterprise buyers rely on personal trust rather than published ratings, a founder's reputation performs the same function that a balance sheet or a brand performs elsewhere. It is genuinely capital — it just cannot be sold, insured, or inherited. Investors habitually underrate it at the start of such a company's life and overrate it at the point where the business needs to outgrow it.

Understand what an SME listing actually gives you — and takes away. The Emerge and BSE SME platforms exist as a runway to the main board, and that migration is where a meaningful share of the return in these names comes from: a main-board listing brings index eligibility, institutional mandates that cannot touch SME paper, and a step-change in liquidity.[^15]

The price of admission is an information environment thinner than most investors are used to. Half-yearly reporting instead of quarterly. No conference calls, therefore no analyst Q&A, therefore no adversarial pressure on the narrative. Company disclosure that arrives primarily as press releases. And a float small enough that a single enthusiastic buyer can move the price 20% in a week. TechD's own trading history — from ₹366.70 on debut to ₹843.60 at the peak to ₹622 in late July 2026 — is a reasonable illustration.¹⁴ The correct response is not to avoid the segment; it is to size positions for the volatility and to do the reconciliation work that no sell-side analyst is doing for you.

There is also a discipline question buried in the SME structure that few investors think about until it bites. Companies on these platforms are permitted lighter continuous disclosure precisely because they are small — but their managements are not therefore less ambitious, and the gap between what they are doing and what they are required to explain widens as they grow. TechD in FY26 incorporated two foreign subsidiaries, launched a product suite, restated a margin base, changed the shape of a major expense line, and put a cross-border acquisition into final negotiation, all under a reporting regime designed for companies doing far less. The regime is not at fault. But an investor relying on mandatory disclosure alone will simply not see most of what is happening.

Greenfield beats roll-up until the moment it doesn't. The GSOC and the university partnerships are the kind of capital allocation that rarely makes headlines and frequently makes money: modest sums, deployed into infrastructure and talent supply within a geography the company already understands, funded from cash flow, with no integration risk and no goodwill on the balance sheet. Compare that with the standard Indian IT services growth playbook of the last decade — buying client relationships offshore at revenue multiples, then discovering the relationships were with people who have since left.

Which is exactly why the Australian acquisition is the most important thing to watch about this company over the next twelve months.¹⁷ It is not that acquisitions are wrong. It is that TechD's entire capital allocation reputation, such as it is at nine months of listed life, rests on a discipline it is about to test in the hardest possible way: a cross-border deal, in a market with no prior operating presence, at a size that would be nearly 40% of the organic revenue base. If it is priced sensibly, structured with real retention, and disclosed in full, it will be evidence that management can allocate capital as well as it can win contracts. If it arrives with a vague press release and no purchase price, that will be evidence too.

↑ Back to Top

XI. Outro & Credits (120:00+)

Ten months after listing, TechD Cybersecurity is a company that has done most of what it said it would do and explained rather less of it than a public shareholder is entitled to expect. It has doubled revenue, held margins in the mid-thirties, generated real cash for the first time, expanded into three new jurisdictions, launched a platform, and built an order book — all without leverage and without the promoters selling a share.³¹⁷⁴

It has also left several material questions unanswered: what happened to its employee cost line, which base produced its stated EBITDA growth, what its platform actually earns, and what it is about to pay for an Australian business.

The gap between those two paragraphs is, in a sense, the defining feature of the entire Indian SME listing cohort. These are real operating businesses — many of them profitable, growing, and run by people who built something from nothing — arriving on public markets with governance and communication habits formed in private ownership, in front of shareholders who have no mechanism to ask a question.

Both of those paragraphs are true at once, and holding them together is the whole discipline of investing in companies at this stage. The regulatory tailwind behind Indian cybersecurity is not in doubt — it is written into RBI directions, SEBI frameworks, and a data protection regime with a 2027 compliance deadline. What is in doubt is which of the roughly two hundred empanelled Indian firms captures a durable share of it, and whether any of them escapes the arithmetic that a services business scales with people and a software business does not.

TechD's answer to that question is TECHD ONE, a 60,000 square foot facility in Ahmedabad, a pipeline of analysts trained in Gujarat's universities, and a founder who has spent twenty years being underestimated by people who were technically correct and commercially wrong. Whether that answer works will not be settled by a press release. It will be settled, slowly, in revenue per employee.

TechD Cybersecurity Ltd

Table of Contents

TechD Cybersecurity: The Rise of India's Cyber-SME Underdog

I. Introduction & Episode Roadmap (00:00 – 05:00)

II. The Legend of the Ahmedabad Cyber Detective (05:00 – 15:00)

III. From Classroom to Boardroom: The Foundations of Techdefence (15:00 – 27:00)

IV. The Gold Standard of Distribution: CERT-In Empanelment (27:00 – 40:00)

V. The SME IPO Frenzy & The Kingmaker's Entry (40:00 – 55:00)

VI. Financial Deep Dive: Deconstructing the Services-Heavy Engine (55:00 – 72:00)

VII. Competitive Benchmarking: TechD vs. TAC Security vs. Sattrix (72:00 – 88:00)

VIII. Capital Allocation & The Expansion Strategy (88:00 – 100:00)

IX. The Investment-Story Spine: Why Win / Why Not (100:00 – 112:00)

The case for winning

The case against

Porter's Five Forces, applied to Indian cyber services

The risk radar that actually applies

Management credibility, assessed on behaviour

The metrics that matter

X. Playbook & Key Investing Lessons (112:00 – 120:00)

XI. Outro & Credits (120:00+)

References