The complete go-to-market reference for e91's Multi-Factor Authentication platform — the anchor product of India's first Identity Security Platform. Positioning, messaging, personas, competitive, sales plays, and marketing motions.
Before we write any pitch or email, we need to be clear about what category we are competing in. Selling MFA as a commodity is a losing game — vendors fight on features and price. We are selling something different.
Sells second-factor auth as a product. Evaluated on token type count, delivery speed, UX. Race to the bottom on price.
Sells a sovereign, government-grade identity security foundation. Evaluated on compliance, deployability, and platform reach.
Every customer conversation, every piece of content, every landing page should reinforce: "e91 ISP is India's Identity Security Platform. Today that starts with MFA. Soon it covers SSO, PAM, IGA, ZTNA."
This matters because buyers who buy "MFA" never expand — they tick a box and move on. Buyers who buy "identity security" are strategic customers who grow with us for 5+ years and have 10x lifetime value.
This is the one paragraph every employee, investor, and partner should be able to recite. It's the source of truth for every downstream message.
For Indian government agencies, BFSI institutions, and critical-infrastructure enterprises who need to secure access to their systems under sovereign compliance requirements, e91 ISP is the Identity Security Platform that protects identity end-to-end — starting with a government-grade, IdP-agnostic MFA platform that deploys in cloud, on-premises, or fully air-gapped environments. Unlike Okta and CyberArk which require rip-and-replace migrations and cannot operate in air-gapped facilities, e91 plugs into your existing identity provider, ships in weeks, and is built for Indian data residency, DPDP/RBI/CERT-In compliance, and post-quantum cryptographic readiness from day one.
Government & Defense — unserved by global OEMs due to air-gap requirements. Highest deal size, longest sales cycle.
BFSI — driven by RBI mandates and audit cycles. Largest market volume in India, strongest reference network.
Critical Infrastructure Enterprise — power, telecom, oil & gas, healthcare, railway. Both regulated and strategic.
Password-only authentication on internal systems
Legacy hardware tokens (RSA SecurID hardware) that cost ₹2,000+ per user
SMS-only OTPs that are phishable
Fragmented MFA implementations bolted into each app separately
Dependence on global SaaS MFA that cannot clear data-residency or air-gap audits
One promise at the top, four value pillars underneath, dozens of proof points at the base. Every asset in this playbook flows from this tree.
Four calibrated pitches for four different situations. Memorize all four. Never ad-lib a pitch — buyers can tell.
Five personas matter for MFA. Each has different pain, different language, different way they want to be sold to.
Three competitor archetypes. For each, specific plays to take the deal.
Against Okta — "We do what Okta does, for the Indian enterprises Okta can't actually serve."
Against ARCON — "We do what ARCON does, with a modern architecture and a platform roadmap."
Against open source — "We are the compliance-wrapped version of what your team would otherwise build in 18 months."
Every real objection we'll hear in the first 100 sales conversations. Internalize the answers — don't read them off a script.
Five stages, clear exit criteria per stage. No deal advances without meeting the criteria. This discipline compounds over time.
A deal that moves from Qualify to Close in under 90 days in government or BFSI is statistically likely to fall through at procurement. Our average sales cycle will be 4-9 months. Celebrate the rigor of stage transitions, not the speed.
Three question sets by buyer type. Ask at least 5 before you make any claim about the product.
A structured demo that speaks to all three buyer types. Every minute is accounted for. Never wing it.
Recap the 2-3 pain points from discovery. Confirm them back. "Last time we met, you told me three things mattered — air-gap deployment for your defense division, RBI audit evidence, and not replacing your Azure AD. Is that still accurate? Anything to add?"
Show the IdP-agnostic plug-in diagram. "Your IdP stays. We add the second factor. This is the critical architecture choice that differentiates us from Okta." Do not go into token types yet.
Real user logs into a real app. Show the MFA challenge appearing. Show the token types toggle — TOTP, Push, FIDO2. Show a failed attempt and the audit log response. Keep moving.
Open the admin console. Query the audit log. Show the tamper-proof integrity verification. Export to a format regulator would accept. This is for the compliance stakeholder.
Based on what matters to them: show air-gap deployment config, OR show RADIUS delegation for legacy VPN, OR show the PQC configuration flag. Pick ONE. Make it memorable.
"Here's what a typical 8-week deployment looks like for a customer like you." Walk through weeks 1-8. Include the SI partner if one is involved. Name their integration partner.
"Based on what I've shown, are there any concerns? Can we scope a 4-week pilot on your [specific system]? I'll send a pilot scope document within 48 hours — who on your team should I include?"
Three tiers. Price per user per year, with platform caps. Air-gap variant is a separate SKU. All prices in INR.
Always price in INR. No USD pricing, ever. This is a differentiator — most global OEMs quote in USD, which immediately signals foreign risk to CFOs.
Annual contracts with multi-year incentive. 3-year commitment = 15% discount. 5-year = 25% discount. We want stickiness; customers want predictability.
Platform expansion credits. 20% of first-year MFA ARR converts to credit toward SSO, PAM, IGA when those products launch. This is how we lock in the platform thesis.
No punitive overage. If they exceed the user count mid-year, we raise the tier at renewal, not mid-term. Customer trust compounds.
Three content pillars we'll own for the next 24 months. Every piece of content maps to one of these.
Every piece of content reinforces that sovereign digital infrastructure needs sovereign identity security. Position e91 as the flag-bearer of Made-in-India cybersecurity.
Be the thought leader on post-quantum cryptography in Indian context. Most Indian CISOs don't know PQC yet. We teach them — and become the answer when RBI mandates it.
Turn compliance complexity into our unique marketing weapon. Publish detailed mappings. Release compliance checklists. Make it easy for CISOs to justify us to their board.
Priority-weighted list. Start with high-priority, low-effort. Graduate as we hire.
Starting templates for the top 5 scenarios. Personalize every one — never send these unedited.
Priya,
I saw your note on LinkedIn about Saket's CSCRF panel last week. One question from that has been on my mind:
When the auditor asks you to produce a tamper-proof MFA log across all privileged systems — not just the Microsoft ones — how many hours does your team spend assembling that today?
We've built an MFA platform specifically for this scenario. Deployed by a similar-size private bank 3 months ago. Happy to share what changed for them and whether it's relevant to you.
15 minutes, next week?
Rakesh,
Thank you for the hour yesterday. To make sure I'm aligned before Thursday's demo:
Your three concerns — (1) integration with your existing Azure AD without replacement, (2) the CSCRF audit cycle in Q2, and (3) extending MFA coverage to the ten legacy systems currently on password-only.
Thursday I'll walk you through: the IdP-agnostic architecture, the audit log feature set, and a specific pattern for adding MFA to legacy RADIUS-based systems without user disruption.
Please confirm if Meera (compliance lead) should join. Her team's questions on retention and data residency are probably best addressed live.
Vikram,
Three data points relevant to your cybersecurity practice:
— 40%+ of your BFSI clients have a live or near-term RBI CSCRF commitment requiring MFA upgrades
— Global MFA OEM margins for you are typically 10-15%
— Your clients increasingly request Made-in-India certified software post-MeitY directives
Our proposal: a partner agreement with 30% margin, deal registration, joint GTM funding for first 3 deals, and implementation certification for your team. We bring the product + air-gap capability; you bring customer relationships + delivery.
I'd like 30 minutes to walk through the partner program. What works — this Friday afternoon, or next Monday morning?
Priya,
No sales pitch today. Just a resource.
We've published a free checklist mapping every MFA requirement in RBI's CSCRF framework to specific controls and evidence artifacts. Our customers have found it useful whether they're evaluating us or not.
Link: [e91.com/rbi-cscrf-mfa-checklist]
If it's useful, I'd love to hear your feedback. If you'd like to reopen the conversation about our platform, my door is open.
Team,
Summarizing our 4-week pilot on the [system] integration:
Success criteria met — (1) p99 auth latency at 140ms (target 200ms), (2) 100% audit log integrity verification pass, (3) zero user-facing incidents, (4) Azure AD integration working with no IdP changes.
Proposed next step: full production rollout covering the remaining 12 systems in scope. Timeline: 8 weeks. Commercial proposal attached.
I'd like to propose a final call next week with your procurement team to walk through terms. What's the best time for you and [CFO/procurement lead]?
Phrases that land. Practice until they come out naturally.
The numbers to track weekly, monthly, quarterly. If it's not here, don't optimize for it yet.
What needs to happen in the next 13 weeks to put this playbook into motion.
We are not selling MFA. We are selling the first pillar of India's Identity Security Platform — and we win because we're sovereign, deployable everywhere (including air-gapped), plug into existing IdPs instead of replacing them, and are post-quantum ready before the market.
Our buyers are CISOs, CIOs, CROs, and Government CIOs who are either tired of stitching together global vendors or structurally cannot use them at all. We meet them where they are — with audit-ready compliance mappings, INR pricing, air-gap deployment, and an honest platform roadmap.
We win with discipline, not noise. Every meeting is a qualified one. Every demo follows the flow. Every POC has exit criteria. Every customer becomes a reference. This playbook is how we make that consistent across 50 salespeople and 5 years.