The Indian Canvas #90: India's grid must clear a cyber exam every year. You cannot switch it off to study.

From April 2027, every big entity on India's power grid needs a cyber audit every nine to fifteen months. The one penetration test the rules name applies before a system goes live; what the annual audit of a running grid must include is still being written. Somebody has to build the simulator.

In the four days of Operation Sindoor in May 2025, while the country watched the border, a second fight ran against the power system. The Power Minister later said India foiled about two lakh cyberattacks on the power sector during those days. Nobody outside the system noticed, because the lights stayed on. That was the point of the defence, and it is also the problem: the grid cannot pause, not for an attack and not for an inspection.

Fourteen months after Sindoor, on July 31, 2026, the Central Electricity Authority notified the Cyber Security in Power Sector Regulations, 2026 in the Gazette of India. I read the notification. It is not an advisory. It is an exam schedule.

What July 31 changed

From April 1, 2027, the rules cover everyone who owns, operates or manages operational technology connected to the interconnected power system, plus the IT systems physically or logically tied to it. Generating companies, captive plants and energy storage operators come in at 50 MW of installed capacity and above. Power exchanges and trading platforms are covered too, and equipment vendors have their own chapters. Smaller players below 50 MW get a nudge toward CERT-In's fifteen basic controls, not the full regime.

The obligations have teeth and clocks:

• A comprehensive cyber security audit of every critical system, every financial year, with the gap between two audits held between nine and fifteen months. The auditor must come from CERT-In's empanelled list or be designated by the Power Ministry, and the same firm cannot audit you three times in a row.

• A cyber incident must be reported to CSIRT-Power and CERT-In within six hours; concluded sabotage in critical systems within twenty-four.

• Every new or replacement critical system must pass a vulnerability assessment and penetration test before commissioning, with details filed to CSIRT-Power within thirty days.

• A standing cyber asset register, bills of materials for systems, a board-approved security policy, a crisis management plan exercised every year with scenarios that cannot repeat.

• Sensitive data encrypted, protected, and resident in India.

Six provisions, including the ISO 27001 clause, start later through separate orders. The rest starts in about five months.

I counted who has to comply

Nobody has published the number of entities the rule covers, so I counted the floor myself.

India has 72 power distribution utilities, per the PFC's Report on Performance of Power Utilities for 2024-25. It has three power exchanges: IEX, PXIL and HPX. For generation, I went through Wikipedia's list of power stations in India, which is maintained against CEA capacity data, and counted every coal, gas and nuclear station listed at 50 MW or more: 204 stations. Hydro stations and the large solar and wind plants add more, and I have not counted transmission licensees or the load despatch centres at all, so treat 279 as a floor, not a total.

Against that demand stands the supply of people allowed to sign the exam: 237 audit firms empanelled by CERT-In as of August this year, for every sector of the economy combined - plus any other auditors the Ministry of Power may designate by separate order, a door Regulation 3(p) leaves open. CERT-In's entire audit machine conducted a little over 9,700 audits in 2024-25 across all sectors. The power sector alone is about to add recurring, OT-heavy audits for what could be dozens to hundreds of legal entities a year - my count is of stations and utilities, and many stations share one owner - and the rotation rule means no utility can simply keep one familiar auditor forever.

Two hundred and thirty-seven firms, most of them built for IT audits, against a sector where the asset under test can trip a city.

You cannot pen-test a grid that is on

Here is the physical problem the regulation quietly creates. The audit chapters and the commissioning rule both imagine vulnerability assessment and penetration testing of critical OT. But classical penetration testing means scanning, probing, sometimes exploiting live systems. In an IT network the worst case is a rebooted server. In a substation or a generating unit, a clumsy scan can trip protection relays, drop a unit, or worse. No sane grid operator lets an auditor fire exploits at a running turbine controller.

So the sector's dirty little compromise has been paper audits: documentation reviews, configuration checklists, interviews. Useful, but they answer "is the policy right." Whether the annual audit will demand proof that an attacker would actually get through is left to audit guidelines yet to be issued; the one place the regulations explicitly require vulnerability assessment and penetration testing is before a new critical system is commissioned (Regulation 5(27)).

The grid cannot be switched off for its own exam. The exam has to move somewhere else.

The Maryland startup that raised for exactly this

In July, Frenos, a startup out of Fulton, Maryland, announced a $1.52 million seed extension led by Momenta and Exposition Ventures, with Riptide Ventures joining, taking its total funding to $6.4 million. What Frenos sells is, in my reading, precisely the machine India is about to need.

Instead of touching the live plant, Frenos builds a digital twin of the customer's OT environment from data the customer already has, and runs fully simulated penetration tests inside the replica. No hardware installed, no scanning of production systems, no downtime. Its reasoning engine, SAIRA, chains vulnerabilities and misconfigurations the way a real attacker would and asks the only question that matters: which paths actually reach the equipment that can disrupt the process.

The results are worth quoting carefully, as the company's own numbers: in one customer environment, SAIRA took more than 12,000 vulnerability findings down to the eight that were genuinely exploitable. Annual recurring revenue is up more than ten times since early 2025, deal sizes up five times, and 2026 bookings had already quadrupled the whole of 2025 by July. Robert M. Lee, the co-founder of Dragos and probably the best-known name in industrial cybersecurity, sits on its advisory board. Frenos's founder Brian Proctor's own framing is the product thesis: every OT operator has a vulnerability list a mile long, and almost none of it matters; what matters is the handful an adversary can actually exploit.

A customer quote on their site says six weeks of consultant time was replaced by two hours of simulated testing. That is the shape of the thing: the audit becomes a computation, not an expedition.

Who does this in India today

I went looking for the Indian version, and the honest answer is: pieces, not the product.

India does have OT security companies. Spharaka Networks in Hyderabad launched an AI-native OT monitoring platform this August. GRIDsentry in Bengaluru works specifically on power-grid cybersecurity. Whizhack, Zindagi's OT Shield and a few others sell monitoring, training and assessment. Critical Range in Delhi runs cyber-range exercises, which train people well but do not test the plant. Bayesian Cybersecurity in Thane does red-team work for battery storage systems, a niche within the niche. The closest lookalike I found, GridGuardAI, trains AI agents in a digital twin of utility environments, but it is based in Minneapolis, not India.

What I did not find is an Indian company selling simulated penetration testing as a product: feed in your asset register and network data, get a defensible map of the attack paths that actually matter, in a format an auditor can sign. The monitoring layer exists. The training layer exists. The exam-hall does not.

The demand is already moving

Three signals say the buying has started before the deadline.

First, SECI issued a Request for Empanelment on August 28 for CERT-In empanelled auditors for the renewable energy sector, amended it on October 5, and wrote in that the first periodic audit of eligible plants must be closed within a year. The state's own renewable energy vehicle is building the auditor pipeline the regulation will need.

Second, a CEA committee reported in August that India should stop importing SCADA systems by 2030 and field indigenous SCADA by 2028-29. Every one of those new Indian systems will need exactly the pre-commissioning security validation the regulations demand. A domestic SCADA industry is a domestic testing market.

Third, the attacker is not theoretical. The two lakh attacks during Sindoor are the only number a minister has put on the record, and CERT-In handled over 29 lakh cyber incidents across the country in 2025. The power sector is the single most-attacked critical sector in every public telling of India's cyber posture.

How I would build this

The wedge is services, not software. Between now and April 2027, every covered entity needs the boring artefacts first: the cyber asset register, the criticality classification, the board-approved policy, the crisis plan. A two-city team of OT-literate engineers can sell readiness projects at services margins today, and every readiness project produces the exact data a digital twin needs. The services desk is how the twin gets fed.

The product is the twin plus the evidence. Ingest the asset register, network diagrams and configurations the rule forces the utility to create anyway. Simulate attack paths against Indian reality: IEC 61850 substations, SCADA over legacy links, remote terminal units with decade-old firmware. Output two artefacts: the ranked handful of exploitable paths for the operator, and an audit-ready evidence pack formatted for what a CERT-In empanelled auditor must verify. The second artefact is what turns a security tool into a compliance purchase, and compliance budgets are the ones that actually exist in a discom.

The channel is the auditor bench, not against it. The 237 empanelled firms hold the signature authority but mostly lack OT tooling. Selling the twin to them as their testing workbench converts the entire incumbent channel into distribution. The rotation rule even helps: auditors rotate, tooling stays.

The data-residency clause is a moat. The regulations require sensitive data to be encrypted, protected and resident in India. A foreign SaaS twin of a discom's network map will spend years in procurement friction over that line. An Indian-built platform, hosted in India, walks through the door the rule itself closes behind it. I would put that clause on the first slide of the pitch deck.

Pricing, stated as a hypothesis. A per-site annual licence in the range a large plant already pays for a single traditional VAPT engagement, plus readiness services billed per project, is my assumption, not a verified number. What I could not verify is what Indian utilities actually pay for OT security assessments today; nobody publishes it, and it is the first question for the pilot below.

A pilot with gates. Gate zero: twenty structured conversations across one state discom, one private genco and two empanelled auditors, to confirm what audits cost now and what the evidence pack must contain. Gate one: build one twin of one substation network from real register data and run the simulated pentest; the test is whether the attack paths found are the ones the plant's own engineers accept as real. Gate two: run it inside one live audit engagement with an empanelled auditor as the customer, and measure whether the auditor's report time actually drops. Gate three: empanelment or formal partnership, then the SECI-style channels. Stop at any gate where the evidence format is rejected, because in this market the signature is the product.

Where it breaks

Utility procurement is slow and political, and five months is short. OT security engineers are scarce; the same scarcity that creates the opportunity also caps the team's hiring. The six deferred provisions could still move scope around. And a simulation is only as good as the register it is fed; Indian utilities' asset documentation is famously incomplete, which is either the product's first problem or its first sale, depending on how the twin handles missing data.

There is also a honest caveat on the attack numbers: the two-lakh figure is a minister's statement, not an audited count, and CERT-In does not publish a power-sector-only incident tally. The direction is certain; the precision is not.

The regulation has written the purchase order: a recurring exam for every big entity, an audit scope still being written for the live grid, and a data-residency clause that locks foreign tools out of the easy route. Whoever builds the exam hall gets to charge rent every nine to fifteen months. India needs its own Frenos, and the deadline is already on the calendar.

Sources: CEA (Cyber Security in Power Sector) Regulations, 2026, Gazette of India, July 31, 2026; Beacon Security's chapter-by-chapter reading of the regulations; QRC's compliance guide on audit cadence and deadlines; NDTV on the Power Minister's Operation Sindoor disclosure; PIB on CERT-In's 237 empanelled auditors; PIB on CERT-In's 9,700 audits in 2024-25 and PIB on 2025 incident counts; PFC Report on Performance of Power Utilities 2024-25; Wikipedia's list of power stations in India, counted by me on October 22, 2026; SECI's auditor empanelment RfE of August 28, 2026 and its October 5 amendment; Moneycontrol on the SCADA indigenisation roadmap; Frenos's funding announcement and product site; Nistify on the round. Cover photo: an electrical substation in Sambalpur, Odisha, by Aliva Sahoo, CC BY-SA 4.0, via Wikimedia Commons. In-article photo: an NTPC thermal power plant, public domain, via Wikimedia Commons. Both are illustrative; they show Indian grid infrastructure, not a specific audited site.