Two umbrellas, six domains, one shared platform core. This is the canonical reference for what we are building under Cybersec91 and Infosec91 — the products today, the products on the roadmap, the customer questions each one answers, and how they share infrastructure.
Imagine a building. Infosec91 is the security desk at the entrance: who are you, can you come in, what rooms can you enter, and is the visitor log auditable. Cybersec91 is the guard team patrolling inside: watching cameras, responding to alarms, chasing intruders, defending the perimeter and the cloud.
You need both. One without the other leaves the building either un-policed or un-audited. We sell them as a unit so customers stop stitching ten vendors together.
Infosec91 = assurance. Slow, careful, evidence-driven. Identity, data, privacy, governance. Tied to compliance frameworks (DPDP, RBI CSCRF, SEBI, IRDAI, ISO 27001, NIST). Customer is the CISO, the DPO, the compliance head. Buying cycle is 6–9 months.
Cybersec91 = defense. Fast, real-time, alert-driven. Threat, application, cloud, AI security. Tied to incident frameworks (MITRE ATT&CK, CERT-In, NIST CSF response phase). Customer is the SOC head, the IR team, the AppSec lead. Buying cycle is 2–4 months, often after an incident.
Both umbrellas share a single platform core: pluggable cryptographic primitives (PQ-ready), tamper-evident audit log (chain-hashed), policy engine (OPA-style), and the deployment substrate (cloud / on-prem / air-gap). Every product on top is a different tenant of that core.
This is how a 14-product suite ships in 36 months instead of 10 years — each new product reuses 60–80% of an existing platform, and only the product-specific business logic and integrations are new code. See Vol 07 · Build Sequence for the dependency graph.
Status legend. ● LIVE shipping in production today · ● BUILDING active development, ships within ~6 months · ○ Y2 committed for year-2 · ◇ Y3 planned for year-3 onward.
"Who is this user, and what are they allowed to do?"
"Where is sensitive data, and is it leaving where it shouldn't?"
"Can we prove to the auditor that controls actually work?"
"Should this device, in this place, be talking to that thing?"
"Something looks wrong. What is it, and how do we contain it?"
"Is the code, the cloud, and the AI we run actually safe?"
The reason a 14-product suite is even feasible. Eight foundational components, built once, that every product builds on. This is the unit economics of the company.
Pluggable post-quantum cryptographic primitives.
ML-KEM for key encapsulation, ML-DSA + SLH-DSA for signatures, classical fallback. Used by every product that signs, encrypts, or authenticates.
Tamper-evident, chain-hashed, append-only event log.
Every authentication, policy decision, data access, and detection event lands here. The forensic substrate behind every compliance export.
OPA-style policy evaluation, sub-millisecond.
One policy language across MFA conditional access, ZTNA gateway decisions, DLP rules, SIEM detections, and Mythos guardrails.
Same product, three deployment models.
Cloud, on-prem, and air-gap from one codebase. The reason we can sell to a fintech and a defence installation in the same quarter.
Unified store of users, devices, agents, services, and their relationships.
Powers MFA, SSO, PAM, IGA — and crucially, gives Mythos a place to register every AI agent as a first-class identity.
Streaming event pipeline with India-resident retention.
Identity events flow into SIEM, SIEM detections flow into SOAR, SOAR responses revoke through the policy engine. One bus closes the loop.
Multi-backend key management — software, HSM, cloud KMS, custom.
The deployment-substrate's twin: a customer can keep keys wherever regulation requires, including a sealed HSM in a Tier-IV datacentre.
Pre-built integrations with everything Indian enterprises actually run.
Azure AD, Okta, AD, LDAP, SAP, Oracle, Finacle, Flexcube, ServiceNow, RADIUS, SCADA / OT historians, plus 50 more. Built once, used by every product.