Secure · Cybersecurity
Identity and access management (IAM) for Indian enterprises with staff, admin and vendor accounts spread across email, cloud and business applications. NetScale reviews who can reach what, then rolls out multi-factor authentication, privileged access management, email security and data loss prevention, AI tools included. Access is reviewed on a schedule agreed in writing.
Identity and Access Management (IAM)
Identity and access management decides who can sign in to what, with what proof, and what they can do once in.
It covers staff, admin and vendor accounts across the directory, cloud and business applications. Here it also covers email, where many attacks begin, and what data can leave. Secure AI usage means a written policy on what staff may put into AI tools, enforced by data loss prevention.
Browser, web and SaaS controls sit under Secure access.
Day-to-day joiners, movers and leavers sit under Cloud ops and service desk (L1 to L3).
Governance of the AI models you build yourselves sits under Custom AI and GenAI solutions.
AI tools were allowed so teams could move faster. Company data now goes into them every day. What are they allowed to see?
Our answer: Secure AI usage
Admin rights were given to get work done. How many accounts still have them?
Our answer: Identity management and single sign-on
Email is protected by a password alone. Which accounts have a second factor?
Our answer: Multi-factor authentication
Vendor engineers sign in to fix things. Who records what they did once inside?
Our answer: Privileged access management
Identity management, secure AI usage, email security, data loss prevention and privacy controls.
One directory for staff, admin and vendor accounts, with single sign-on to business applications and joiners, movers and leavers recorded.
A second factor on every account, with phishing-resistant methods first for admins, finance and remote access.
Admin and vendor sessions approved, time-limited and recorded with Arcon, with admin rights removed where no role needs them.
A written policy on which AI tools are approved and what may go into them, enforced by data loss prevention and reviewed as tools change.
Sender authentication, link and attachment scanning and impersonation checks on Proofpoint or Barracuda, in front of the mail platform you already run.
Rules for what personal and company data may leave through email, endpoints and AI tools, with every block and exception logged.
One request path from a person to your data, drawn three times.
You can stop at any phase boundary. The assessment is free, and each phase is priced in writing before it starts.How we engage
The DPDP Rules name access control, and monitoring and logging, among the reasonable security safeguards for personal data. The access reviews and data loss logs are that evidence. Legal interpretation stays with your counsel.
Source: Digital Personal Data Protection Rules, 2025 (external site)
Under the Directions of April 2022, authentication logs are kept for a rolling 180 days within India, with clocks synchronised to NIC or NPL.
User and mailbox count, and how many accounts need phishing-resistant MFA first.
Privileged and vendor account count.
Applications to connect to single sign-on.
Data loss prevention scope: email only, or endpoints and AI tools too.
The most relevant engagement, with its numbers. Client names and the full write-up are shared in conversation.
Industrial manufacturing · Nine plants, seven cities
How a multi-site industrial company scoped a security programme across its network, devices, user access and sites.
Privileged access management
Cloud platform and identity
Email security and awareness
Email protection and backupOur own information security and privacy management systems, run under both standards.
Certifications and technologyMulti-factor authentication that a fake login page cannot capture and replay, such as a hardware security key or a passkey tied to the device. One-time codes sent by SMS or typed from an app can be phished. We roll it out first to the accounts with the most access.
Usually, yes. MFA checks who is logging in; privileged access management controls what an admin or vendor account can do once inside, and records it. With Arcon, privileged sessions are approved, time-limited and logged, which is the evidence an auditor asks for.
With a written policy on which AI tools are approved and what may go into them, enforced by data loss prevention. Personal data and confidential files are blocked or flagged by policy before they leave. Approved tools sit behind single sign-on, so access ends when someone leaves. The policy is reviewed as tools change.
No. Proofpoint and Barracuda sit in front of the mail platform you already run, such as Microsoft 365. They check sender authentication, links, attachments and impersonation before a message reaches the inbox. No filter catches everything, so the monthly report shows what was stopped and what got through.
It costs nothing and commits you to nothing. You get a written list of where your IT environment is exposed, and your team can act on it with or without us.
