A deep-tech strategy brief explaining how e91's MFA platform becomes the foundation for an entire identity and access management suite — and why this is defensible against Okta, CyberArk, and Microsoft in the Indian market.
Before we talk strategy, let's make sure we're aligned on what we're actually building.
Passwords can be guessed, phished, stolen, or leaked. 81% of cybersecurity breaches involve stolen or weak credentials. A password is one thing you know — but attackers can know it too.
MFA requires at least two proofs: something you know (password), something you have (phone, key), and/or something you are (fingerprint). Even if one factor is stolen, the attacker can't complete the login.
Here's what actually happens when a user logs into any enterprise application protected by your MFA platform. This is the flow that happens hundreds of times per second in a real deployment.
A bank employee tries to log into their core banking system with their username and password.
The application forwards credentials to Azure AD, Okta, or LDAP — the existing identity provider. Your platform is not involved yet.
After the password passes, the application calls your /validate/check endpoint with the user's name and the OTP code they entered. This is the single API that everything flows through.
Your platform loads the user's registered tokens, verifies the OTP using timing-safe cryptographic comparison, writes to the tamper-proof audit log, and returns a simple true or false.
If both password and OTP are correct, the user is logged in. If either fails, access is denied and the event is logged for compliance audit.
Your MFA platform returns a single boolean — true or false. This extreme simplicity is intentional. It means any existing application — a 20-year-old banking mainframe, a modern SaaS HR tool, a government VPN — can integrate with your platform in a few hours, without re-architecting anything.
This is how you win enterprise deals in India where customers have sprawling legacy environments. Okta and global OEMs typically require deeper architectural commitment. You don't.
Your platform doesn't compete with the customer's existing identity system — it plugs into it. This is the single biggest commercial advantage buried in your technical spec, and here's why.
When Okta pitches to an Indian bank, the CIO has to approve a 12-18 month project to migrate away from their Microsoft Active Directory. That requires board approval, budget approval, and carries huge risk. Many times, the deal simply doesn't happen.
When you pitch the same bank, you're saying "keep everything you have — we just add the second factor." The CIO can approve this at their level. The deal closes in weeks, not years. This is why your sales motion is structurally faster.
Your platform can run in environments that have no internet connection at all — defense networks, nuclear facilities, intelligence agencies, critical infrastructure. Okta, Microsoft, and CyberArk structurally cannot operate here.
Okta, Microsoft Entra, and CyberArk Cloud are fundamentally SaaS products. They require outbound connections to authentication servers, telemetry endpoints, push notification services, and cloud KMS.
In an air-gapped facility, none of those connections are allowed. Re-architecting their products for air-gap would take years and break their core product model. Your platform was designed for this from day one.
This is the most important slide in this document. The components you're building for MFA are not MFA-specific — they're a reusable foundation for an entire identity security suite. Every future product inherits 40-60% of its work from here.
Building PAM from scratch would take a typical vendor 18-24 months and cost ₹8-12 crores in engineering. Because your foundation is already there, you can ship PAM in 9-12 months at roughly half the cost. Same for IGA, ZTNA, and Secrets Management.
This compounding leverage is why platform companies outperform single-product companies in public markets — and why building the MFA anchor correctly matters so much more than building it quickly.
Your platform supports 8 different ways to prove the second factor. Each matters for a different customer segment. Here's how to think about them commercially.
Time-based OTP from Google Authenticator, Microsoft Authenticator. Most common.
Counter-based OTP for legacy hardware tokens (RSA SecurID style).
6-digit code sent to the user's phone. Universal but phishable.
8-digit code sent via SMTP. Secondary factor for enterprise.
Modern approve-on-phone with number matching. Anti-phishing.
Security keys (YubiKey) and passkeys. Highest security tier.
Delegate to network equipment. Critical for VPN and router auth.
Single-use enrollment tokens for new-user onboarding.
Within 5-10 years, quantum computers will be able to break today's encryption. Your platform is architected to survive this transition — a rare capability in Indian cybersecurity and a genuine moat.
Indian regulators (CERT-In, NCIIPC, MeitY) are actively watching NIST and NCSC guidance. PQC mandates are expected within 2-4 years for critical infrastructure and defense. BFSI will follow within 5 years.
When that happens, every vendor without a PQC-ready architecture faces an 18-month scramble. You flip a configuration flag. This is the difference between a 3-month sales win and a 3-year absence from the market.
Building the MFA anchor first, then layering products in a sequence that maximizes platform reuse and follows the buyer's budget cycle.
Ship core platform via 20-week development plan. Run 2-3 design-partner pilots with BFSI and government. Begin MeitY empanelment conversations. Foundation layer (audit, KMS, RBAC, policy, crypto) is built here and reused forever.
General availability. Package MFA + SSO + Passwordless as single SKU. Close first 10-15 paying customers. Establish channel with 2-3 Indian SIs (Wipro/TCS/HCL).
Privileged Access Management. Target BFSI first — RBI mandate is natural sales trigger. Hire dedicated team of 6-8 engineers. This is where ARR begins to scale meaningfully.
Complete the workforce identity story. Unlocks large PSU and audit-heavy BFSI deals. Device trust becomes foundation for ZTNA.
Position post CERT-In 2022 directives. Bundle with device trust + MFA step-up. Air-gap variant unlocks defense ZTNA market.
Separate team, separate GTM. Indian fintech, e-commerce, insurance. Native Aadhaar + DigiLocker + UPI. Different buyer persona (CDO/CPO, not CISO).
SEA, Middle East, Africa using same compliance-first playbook. These geographies have similar data-localization demands and respect Indian technology.
A clean framework for every future product decision. If a product fits Tier 1, build it. Tier 2, plan it. Tier 3, partner or skip.
Where you can win against global OEMs and Indian incumbents, and where you should not show up.
| Product | vs Global OEMs | vs Indian players | Your edge |
|---|---|---|---|
| MFA Platform | Can win | Can win | Air-gap + PQC-ready + IdP-agnostic |
| SSO | Can tie | Can win | Bundled MFA + unified audit log |
| Passwordless | Can tie | Can win | RBI-ready; FIDO2 already built |
| PAM | Win on price | Win on tech | Cloud-native + air-gap vs legacy ARCON |
| IGA-lite | Tie mid-market | Can win | India audit templates + unified platform |
| ZTNA | Hard standalone | Can win | Win only after identity suite established |
| CIAM | Tie fintech | Can win | Aadhaar, UPI, DigiLocker native |
| EDR, SIEM, DLP, Firewall | Will lose | Will lose | Do not compete |
1. Your MFA spec is not a commodity product. The combination of air-gap deployment, post-quantum readiness, and IdP-agnostic plug-in architecture makes it a government-grade security platform. Position it — and price it — accordingly.
2. Do not split engineering focus before MFA Phase 4 is complete. The foundation components you're building (audit log, KMS envelope, RBAC, policy engine, crypto abstraction) are the basis for every product that follows. Cutting corners now creates compounding cost over 3 years.
3. Sequence discipline wins. MFA GA → SSO + Passwordless bundle → PAM → IGA → ZTNA. CIAM runs as a parallel product line from month 12 with its own team.
4. Your moat is structural, not feature-based. India-first compliance, air-gap deployability, PQC architectural readiness, and platform-wide component reuse. These cannot be copied by Okta or CyberArk without rebuilding their products from scratch.
Target outcome: Become India's Okta + CyberArk hybrid — with a 2-3 year head start on PQC — before going global to SEA, Middle East, and Africa.