CERT-In gives you 6 hours to file

Catch the intruder. Beat the six‑hour clock.

CyberSharcX spots intruders in seconds with decoy systems, then hands you the regulator-ready report before CERT-In’s deadline runs out. Built for Indian startups and SMEs without a security team.

Get a free breach exposure checkRead a real incident report
CERT-IN WINDOW
Illustrative: how the filing window runs down after detection.
YOUR NETWORK · 6 SYSTEMS2 ARE DECOYS

Play the attacker. Click any system to probe it. Real users never touch the decoys, so only an intruder ever trips one.

Detection to alert
Under 15 seconds
Time to deploy
Under 30 minutes
Legitimate traffic on a decoy
None, so alerts are high-signal
How it works

A trap only an attacker can trigger.

Most tools guess at what looks unusual. A decoy doesn’t guess: real users never touch it, so a touch is the evidence.

  1. 01

    Place decoys where attackers look

    Run a fake SSH or web server with our forwarder beside it, or drop a canary Word or Excel file next to your real documents. Nothing is installed on your real systems.

  2. 02

    An intruder touches one

    No one on your team has a reason to touch a decoy. So the moment something does, it is a confirmed intruder, and you're alerted in seconds, not the 181-day global average.

  3. 03

    You get the report, not a riddle

    A plain verdict on whether CERT-In and DPDP reporting apply, a pre-filled filing pack, and a numbered checklist a non-technical founder can follow at 2 AM.

The report is the product

Written for the regulator. Readable at 2 AM.

Every incident produces a report that opens with the only question that matters, then walks you through severity, evidence and exactly what to do next. This one came from a real detection.

Open the full sample report
DO YOU NEED TO REPORT THIS TO THE GOVERNMENT?Report ID 25546802 · 14 Jul 2026, 01:42 IST
CERT-IN: LIKELY NOT REQUIREDOnly a decoy was accessed. Early warning, not a confirmed breach.
DPDP: NOT TRIGGEREDThe decoy held no real personal data — no DPDP breach.
Detected 01:42:12 · Confirmed 01:42:23 — 11 secondsRead the full report →
The two clocks

One incident starts two clocks. One report answers both.

From the moment of detection, CERT-In and the Data Protection Board each run their own deadline. Your report tells you whether each applies, and comes pre-filled if it does.

CERT-In · incident report6 hours from noticing
In force today for all Indian entities. Partial information within the window is acceptable; supplement later.
DPBI · breach notificationWithout delay · detailed report in 72 hours
No minimum breach size: every personal-data breach is reportable to affected people and the Board.
The stakes

The numbers are already law.

181 days
Average time to identify a breach, globally. IBM Cost of a Data Breach 2025
₹250 Cr
Maximum DPDP penalty for inadequate safeguards, plus ₹200 Cr for failing to notify a breach.
6 hours
CERT-In's incident-reporting window from when you notice. Already in force.
13 May ’27
DPDP breach-notification duties enforced in full. Rules notified 13 Nov 2025.
HONEST BY DESIGNWorks alongside your existing antivirus or Microsoft Defender: we’re the detection-and-reporting layer, not a replacement.
Straight answers

What founders ask us first.

What is CyberSharcX?

CyberSharcX is an Indian breach-readiness platform that detects intruders with decoy systems and produces a regulator-ready incident report. It tells a company whether CERT-In and DPDP reporting apply to an incident, with the filing details pre-filled. It is built by CyberSharcX Private Limited in Kanpur, Uttar Pradesh, for startups and SMEs without a security team.

What is CERT-In's 6-hour reporting rule?

CERT-In's Directions of 28 April 2022 require covered cyber incidents to be reported to CERT-In within 6 hours of noticing them. The rule applies to Indian entities, lists incident types that include data breaches, unauthorised access and even targeted scanning, and accepts partial information within the window, with the rest sent later.

What does the DPDP Act require after a personal data breach?

Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, a company must tell every affected person and the Data Protection Board of India about a personal data breach without delay, and send the Board a detailed report within 72 hours. There is no minimum breach size. These duties are enforced in full from 13 May 2027.

What is a decoy, and why are its alerts reliable?

A decoy, also called a honeypot or canary, is a fake server or file that no legitimate user has any reason to touch. Because normal activity never reaches it, any interaction is a strong signal of an intruder, which is why decoy alerts have very few false positives compared with tools that look for unusual behaviour.

Who is CyberSharcX for?

CyberSharcX is for Indian startups and SMEs that must meet CERT-In and DPDP reporting duties but have no security operations team. It is also built to be offered by MSPs, IT resellers, CA firms and DPDP consultants to their clients.

Before the clock starts

Know your exposure before an attacker does.

A free breach exposure check shows what an intruder would find in your environment, and what you would have to report.

Get a free breach exposure checkSee what every plan includes