Most cybersecurity companies sell a wall. Kratikal Tech built its business on the opposite bet: that the wall is already broken, and the hole is the human being reading email. That contrarian idea took a training institute started by three NIT Allahabad batchmates in 2013 all the way to a stock exchange listing on 7 July 2026, where its shares closed their first day at ₹182.40 against an issue price of ₹135 (BSE SME data), a gain of about 35% on debut.
The numbers behind that debut are the part worth pausing on. Kratikal reported revenue from operations of ₹36.72 crore (about $3.8 million) in FY26, up from ₹9.14 crore in FY23, roughly a fourfold rise in three years, with profit after tax of ₹6.14 crore (company financials cited in the RHP). This is the story of how a phishing-simulation tool called ThreatCop turned “your employees are the vulnerability” into a listed, profitable business, and where the fragile parts of that story still sit.
Quick facts
| Company | Kratikal Tech Limited (formerly Kratikal Tech Private Limited) |
| Founded | 2013, Noida, Uttar Pradesh |
| Founders | Pavan Kushwaha (CEO), Paratosh Bansal, Dip Jung Thapa — NIT Allahabad batchmates |
| Businesses | ThreatCop (people security management / phishing simulation and awareness); AutoSecT and Kratikal services (VAPT, security audits, NSE system audits) |
| Latest FY revenue | ₹36.72 crore (FY26, revenue from operations) |
| Latest FY profit | ₹6.14 crore PAT (FY26); EBITDA ₹9.08 crore |
| Listed | 7 July 2026, BSE SME (SME IPO) |
| Market value at issue | Post-issue market cap about ₹149.86 crore at the ₹135 issue price (IPO tracker data) |
| Key shareholders | Promoter Pavan Kushwaha (largest holder, ~44% pre-issue per DRHP); Paratosh Bansal; Dip Jung Thapa |
What they do
Kratikal sells cybersecurity to organisations, and it splits that into two clear jobs. One is stopping the attack that targets people. The other is finding the technical holes before an attacker does. The company describes itself in its IPO filings as an AI-driven, SaaS-based cybersecurity provider, and it groups its work under two brands.
- ThreatCop (People Security Management): a platform that runs simulated phishing, ransomware and smishing attacks on a company’s own employees, then trains the ones who click. The pitch is measurable human risk reduction rather than another firewall.
- Kratikal and AutoSecT (Technology and Process Security): vulnerability assessment and penetration testing (VAPT), source-code review, compliance and security audits, plus system audits for trading members that the National Stock Exchange requires.
- Credentials it leans on: Kratikal is CERT-In empanelled (2021, per company statements) and is authorised to conduct NSE system audits — both are gatekeeping certifications that let it sell to regulated buyers.
The origin
Kratikal did not begin as a product company. In 2013 Pavan Kushwaha and two batchmates from NIT Allahabad, Paratosh Bansal and Dip Jung Thapa, set it up as a cybersecurity training and awareness venture. The founding insight was unglamorous and, at the time, unfashionable: the expensive breaches they read about were rarely a failure of the firewall. They were a failure of a person, one careless click on a convincing email.
The rest of the industry was selling technology to defend the perimeter. Kushwaha’s group decided the more durable business was defending the people inside it, because you cannot patch a human with a software update. You have to test them, measure them, and train them, again and again. That reframing, from “block the attack” to “reduce the human risk”, is the thread that runs through everything the company later built, and it is the reason its flagship product simulates attacks on your own staff rather than trying to keep every attacker out.
The struggle years
Turning a training idea into a software company took years, and the accounts show the strain. Kratikal spent its early life as a services and awareness shop before it had a repeatable product, and even in the run-up to its IPO the financials reveal how thin the ground had been. In FY23, the earliest year disclosed in its offer documents, the company posted revenue of ₹9.14 crore but an EBITDA of roughly negative ₹0.12 crore — it was, on an operating basis, barely breaking even.
Two hard problems defined these years:
- The pivot from institute to product (from 2013): a training and awareness business does not scale the way software does. Building ThreatCop into a repeatable SaaS platform meant re-tooling the company around product engineering and recurring revenue, a multi-year rebuild rather than a single launch.
- Selling a category buyers did not have a budget for: “employees are your vulnerability” was a harder sell than a firewall in the 2010s. Kratikal had to educate the market that human risk was a line item at all, which is slow, expensive work reflected in those years of near-flat operating profit.
The company was incubated with government support and recognised under the Startup India initiative, which helped it survive the stretch when the product and the market were both still forming.
The turning point
The turn is visible in two numbers on either side of a single stretch. In FY23 Kratikal did ₹9.14 crore of revenue and essentially no operating profit. By FY26 it did ₹36.72 crore of revenue, EBITDA of ₹9.08 crore and PAT of ₹6.14 crore. In three years the top line multiplied about four times and the company went from operating break-even to a mid-teens net margin.
What flipped it was product mix and reach. As ThreatCop matured into a SaaS platform and Kratikal pushed into overseas markets through its subsidiaries, revenue compounded fast: ₹13.01 crore in FY24, ₹20.85 crore in FY25 (DRHP), and ₹36.72 crore in FY26. That trajectory is what made a small-cap IPO credible. When Kratikal Tech Limited opened its offer on 30 June 2026, the book was covered many times over — trackers reported overall subscription figures ranging from about 154 times (Chittorgarh) to roughly 221 times (IPO trackers) — and the stock listed on 7 July 2026 well above its ₹135 issue price. The turning point was not the listing itself; it was the three years of compounding that made the listing possible.
The money behind it
Kratikal was not a heavily venture-funded company, which is part of why it could list profitably. Its external capital came in modest rounds, and the largest single raise was the IPO itself.
- Pre-Series A, about $1 million (December 2019): led by Gilda VC and Artha Venture, with Rajeev Chitrabhanu (founder of JM Financial’s Magnetic) and others including LetsVenture participating (Inc42). The money was earmarked for product development, marketing and expanding the team and offices.
- Total private funding was small: aggregators such as Crunchbase put Kratikal’s total funding at roughly $1.93 million across about four rounds before the IPO — a fraction of what venture-backed security startups typically burn.
- Anchor round, ₹11.22 crore (29 June 2026): ahead of the public issue, Kratikal allotted 8,31,000 shares at ₹135 to eight anchor investors, the day before the IPO opened.
- The IPO, about ₹39.69 crore (July 2026): a 100% fresh issue of 29,40,000 equity shares of ₹10 face value on the BSE SME platform, with Beeline Capital Advisors as lead manager and KFin Technologies as registrar. Proceeds are earmarked for scaling the overseas subsidiaries, sales and marketing, workforce and product development, and general corporate purposes.
Because the offer was entirely fresh capital rather than an offer for sale, the founders did not cash out at listing; the money went into the company.
How it makes money
Kratikal earns from two engines with different economics, and the mix is what drives the margin story.
- Recurring SaaS subscriptions (ThreatCop): organisations pay for the platform that runs phishing simulations and security-awareness training across their workforce. This is the higher-margin, recurring part of the business and the one investors valued most, because it scales without proportional cost.
- Security services and audits (Kratikal / AutoSecT): VAPT engagements, source-code reviews, compliance audits and NSE system audits. These are project-based and more people-intensive, so they carry lower margins than SaaS but bring in regulated, sticky enterprise buyers.
- Geographic spread: the company sells in India and abroad, operating overseas subsidiaries Threatcop FZ LLC (UAE) and Threatcop AI Inc (US) to reach Middle Eastern and North American buyers. It says it serves 750+ organisations across 30+ countries (company-stated).
- Where the margin sits: EBITDA rose from ₹3.87 crore in FY24 to ₹9.08 crore in FY26, so the operating margin has widened as the recurring SaaS mix has grown — the part people get wrong is assuming a “cybersecurity” company is uniformly high-margin, when in fact the services line dilutes what the SaaS line earns.
The numbers
Three points to read alongside the table. First, growth has been steep and consistent. Second, the company has been profitable, not a loss-making growth story. Third, the FY25 figures differ slightly between the January 2026 DRHP and the later red-herring prospectus because of restatement, so both variants are shown where they diverge. All figures are in ₹ crore.
| Metric (₹ crore) | FY23 | FY24 | FY25 | FY26 |
| Revenue from operations | 9.14 | 13.01 | 20.85–21.15 | 36.72–36.86 |
| EBITDA | -0.12 | 3.87 | 5.51 | 9.08 |
| Profit after tax | n/a (near break-even) | 3.20 | 3.81–4.23 | 6.14 |
| Net worth | n/a | n/a | 11.13 | 24.02 |
The FY25-to-FY26 jump — revenue up roughly 75% and PAT up about 61% — is the growth that carried the IPO. On the ₹135 issue price the post-issue market cap was about ₹149.86 crore, a trailing P/E of roughly 24 (IPO tracker data), which is modest for a profitable SaaS-leaning security business and helps explain the heavy oversubscription.
Where the money comes from
The revenue splits along two axes — what it sells and where it sells — and there is a surprise in each.
- By product: the ThreatCop people-security platform is the growth and margin driver, while the Kratikal/AutoSecT services line (VAPT, audits, NSE system audits) is the steadier, lower-margin base.
- By geography: Kratikal is not only an India story. It reports exports through its UAE and US subsidiaries — export revenue was ₹1.81 crore in Q1 FY26 alone (DRHP) — and it counts clients across 30+ countries, which is unusual for a company this size.
- The surprise on the client list: as far back as 2019, when it had barely 100 clients, Kratikal was already selling to names like Kotak Mahindra Bank, Aditya Birla Capital, PVR Cinemas, Cars24 and Pine Labs (Inc42). A small company was landing large, security-conscious enterprises early — evidence the product cleared a real bar before it had scale.
The risks
The growth is real, but so are the pressure points, and they are structural rather than cosmetic.
- Small absolute size in a giant, well-funded market. At ₹36.72 crore of revenue, Kratikal is tiny next to global security-awareness and VAPT vendors. Its total pre-IPO private funding of roughly $1.93 million means it competes on price and focus, not on a war chest, and a better-capitalised rival can out-spend it on distribution.
- Concentration and lumpiness in services. The audit and VAPT business is project-based, so revenue can be lumpy quarter to quarter, and dependence on regulatory mandates (like NSE system audits) or a handful of large accounts makes the top line sensitive to a few decisions outside the company’s control.
- Execution risk on the overseas bet. A meaningful chunk of the IPO proceeds is going into scaling the UAE and US subsidiaries. International expansion is where small Indian software firms most often stumble on go-to-market cost, and if that spend does not convert into recurring revenue, the margin gains of the last three years could reverse.
- SME-platform liquidity. As a BSE SME listing, the stock trades in a smaller, less liquid segment than the main board, which can amplify price swings well beyond what the underlying business is doing.
The takeaway
The transferable lesson from Kratikal is about sequencing, not cybersecurity. The company spent years being unfashionable — insisting the vulnerability was the person, not the perimeter, and running an awareness business while the market wanted firewalls. It stayed small, took very little outside money, and reached operating break-even before it reached scale. Then, once the product and the market finally lined up, the compounding was fast and it went public profitable rather than promising to be profitable someday. In a startup culture that prizes raising the biggest round, Kratikal is a reminder that being right early and staying solvent long enough for the market to catch up is its own kind of strategy.
Frequently asked questions
What does Kratikal Tech do?
Kratikal is a cybersecurity company. Through its ThreatCop platform it runs simulated phishing and other attacks on a company’s own employees and trains them to reduce human risk, and through its Kratikal and AutoSecT lines it provides VAPT, security audits and NSE system audits.
Who founded Kratikal and when?
It was founded in 2013 in Noida by three NIT Allahabad batchmates: Pavan Kushwaha, who is CEO, along with Paratosh Bansal and Dip Jung Thapa.
Is Kratikal Tech a listed company?
Yes. Kratikal Tech Limited listed on the BSE SME platform on 7 July 2026 after an SME IPO priced at ₹135 per share; the stock closed its first day around ₹182.40, roughly 35% above the issue price.
How much money does Kratikal make?
In FY26 the company reported revenue from operations of about ₹36.72 crore, EBITDA of ₹9.08 crore and profit after tax of ₹6.14 crore, up from ₹9.14 crore of revenue in FY23.
How much did Kratikal raise before its IPO?
Relatively little. It raised about $1 million in a pre-Series A round in December 2019 led by Gilda VC and Artha Venture, and aggregators put its total private funding at roughly $1.93 million before the IPO, which was a fresh issue of about ₹39.69 crore.
Sources
Figures are as of September 2026. Currency converted at $1 ≈ ₹96.0 as of 18 September 2026 (Trading Economics).
- Chittorgarh — Kratikal Tech IPO details, dates, subscription and financials (July 2026)
- Medianama — “Cybersecurity firm Kratikal Tech files DRHP for IPO” (January 2026)
- Inc42 — “Kratikal raises $1 Mn to enhance tech infrastructure” (December 2019)
- IPOJi — Kratikal Tech IPO subscription, market cap and P/E (July 2026)
- Dealroom / Crunchbase — Kratikal funding history and total raised (2026)
- Business Standard — Kratikal Tech Ltd quarterly results / listing (July 2026)
- Kratikal and ThreatCop company websites — product descriptions, client and country counts, CERT-In empanelment (2026)
Found an error? Write to us and we’ll correct it in the open, dated, on the piece.