The sequence is not a wishlist. Every package depends on something earlier in the chain — the identity graph, the policy engine, the audit fabric, and the pluggable crypto layer. Build the foundations once, and Cybersec91 + Infosec91 compose on top in order.
Before any product ships, four shared substrates must exist. Each one is consumed by every product on the roadmap. Investing here first is the difference between a coherent suite and seven disconnected vendors in a trench coat.
Investment rule. No product is allowed to ship its own auth, its own policy DSL, or its own log format. Foundation work is never deferred for product velocity — it is the multiplier that gives us product velocity.
Read it left to right. Each arrow is a hard dependency — the upstream node must be production-grade before the downstream one can ship. Soft dependencies (data feeds, UX cohesion, shared concepts) are not drawn.
Establish the foundations and ship a credible identity stack: phishing-resistant MFA, federated SSO, audit-grade logging. Win regulated-sector deals on compliance posture and air-gap fit.
Build privileged-access, governance, and zero-trust network access on top of the identity beachhead. Address the helpdesk-fraud, leaver, and VPN-flat threat classes head-on. DPDP enforcement is the wedge.
SIEM with native identity correlation. Endpoint trust attached to the identity graph. Data-security + compliance-automation closing the regulator loop. We become the platform — not a point tool.
Mythos extends every foundation to AI agents: agent identities, agent-to-agent auth, prompt firewall, tool-call policy, deepfake detection. SOAR + AppSec + CSPM round out the suite. We are the only India-headquartered platform with a coherent agent-identity story.
Pressure to ship the next product faster causes shortcuts in the identity graph or policy engine. Each shortcut compounds — every later product re-implements its own auth, audit, or crypto.
SSO blocks IGA, ZTNA, and most of Phase 2. Connector-grade integration with 30+ SaaS apps is more work than visible from the outside.
India-resident hot+cold storage at competitive cost is non-trivial. If we miss the cost target, customers default to global SIEM despite residency risk.
If we ship Mythos too early, no agent-identity sprawl yet — no buyers. Too late and global hyperscalers (or one of OpenAI / Anthropic / Google) own the category.
RBI / SEBI / CERT-In requirements change between phases. A product designed against today's framework misses tomorrow's audit.
Crypto, identity, and AI-security expertise are scarce in the India market. Every phase has a single-point-of-failure technical leader risk.